Op 02-09-15 om 01:36 schreef Stefan Suurmeijer: > Hi Paul, > > a fellow Groninger? Then lets try to help ;-) Nice to know ;-) > From the OSX v10.11 release notes (released 15-8): > > * DHE_RSA cipher suites are now disabled by default in Secure > Transport for TLS clients. This may cause a failure to connect to > TLS servers that only support DHE_RSA cipher suites. Applications > that explicitly enable cipher suites using SSLSetEnabledCiphers() > are not affected. Safari may display a “Safari can’t establish a > secure connection to the server” error page. Safari and other > clients of CFNetwork API (NSURLSession, NSURLConnection, > CFHTTPStream, CFSocketStream and Cocoa equivalent) will show a > “CFNetwork SSLHandshake failed” error in Console. > > > Maybe you can use checktls.com to find out which cipher your site uses. > A very useful site. Interesting site, but I need more time to understand the tests. When I use openssl, I get a long timeout after "CONNECTED", and then something what looklikes there is no certificate available at all: ----------------- paul@server2:~$ openssl s_client -connect mail.vandervlis.nl:993 CONNECTED(00000003) write:errno=104 --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 295 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE --- paul@server2:~$ ----------------- Port 465 (postfix SSL/TLS) has the same problem. When I use openssl to port 443 what uses the same certificate, everything is fine. But TLSv1 with DHE-RSA-AES256-SHA cipher is used. I am using a SHA256 certificate with a 2048 bit public key. Realize that this has worked for a long time, and so far I know I did not change anything. On my new mailserver port 993 (Cyrus 2.4.17) works fine with the same certificate. (Only tested with openssl.) > If your site uses a DHE-RSA cipher, you may need to change the > tls_cipher_list in your imapd.conf I only accept TLSv1 high-security ciphers: tls_cipher_list: TLSv1+HIGH:!aNULL:@STRENGTH The problems are not very big, I can tell the people to change port 993 to port 143 in the client, this fixes the problem. Most people are already using port 143. With regards, Paul van der Vlis. -- Paul van der Vlis Linux systeembeheer Groningen https://www.vandervlis.nl/ ---- Cyrus Home Page: http://www.cyrusimap.org/ List Archives/Info: http://lists.andrew.cmu.edu/pipermail/info-cyrus/ To Unsubscribe: https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus
