On 2-9-2015 12:56, Paul van der Vlis wrote:
Op 02-09-15 om 01:36 schreef Stefan Suurmeijer:
From the OSX v10.11 release notes (released 15-8):
* DHE_RSA cipher suites are now disabled by default in Secure
Transport for TLS clients. This may cause a failure to connect to
TLS servers that only support DHE_RSA cipher suites. Applications
that explicitly enable cipher suites using SSLSetEnabledCiphers()
are not affected. Safari may display a “Safari can’t establish a
secure connection to the server” error page. Safari and other
clients of CFNetwork API (NSURLSession, NSURLConnection,
CFHTTPStream, CFSocketStream and Cocoa equivalent) will show a
“CFNetwork SSLHandshake failed” error in Console.
Maybe you can use checktls.com to find out which cipher your site uses.
A very useful site.
Interesting site, but I need more time to understand the tests.
When I use openssl, I get a long timeout after "CONNECTED", and then
something what looklikes there is no certificate available at all:
-----------------
paul@server2:~$ openssl s_client -connect mail.vandervlis.nl:993
CONNECTED(00000003)
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 295 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
---
paul@server2:~$
-----------------
Port 465 (postfix SSL/TLS) has the same problem.
When I use openssl to port 443 what uses the same certificate,
everything is fine. But TLSv1 with DHE-RSA-AES256-SHA cipher is used.
I am using a SHA256 certificate with a 2048 bit public key.
If that cipher is used on port 993 as well, then probably connecting
from an Apple OSX machine won't work (I assume that is what you're
testing?), since Apple no longer allows DHE-RSA, as stated above.
But connecting from an Apple machine to port 443 using the same
cipher does work? Maybe because you're using the
SSLCipherSuite option in your Apache config? From the release notes,
that might not be affected ("Applications that explicitly enable
cipher suites using SSLSetEnabledCiphers() are not affected")
Realize that this has worked for a long time, and so far I know I did
not change anything.
On my new mailserver port 993 (Cyrus 2.4.17) works fine with the same
certificate. (Only tested with openssl.)
What cipher does that one use? The certificate isn't the problem I
think, the cipher you use probably is.
If your site uses a DHE-RSA cipher, you may need to change the
tls_cipher_list in your imapd.conf
I only accept TLSv1 high-security ciphers:
tls_cipher_list: TLSv1+HIGH:!aNULL:@STRENGTH
Hm, I don't know if that would allow DHE-RSA, maybe someone from
Horde knows that
KR
Stefan
|
----
Cyrus Home Page: http://www.cyrusimap.org/
List Archives/Info: http://lists.andrew.cmu.edu/pipermail/info-cyrus/
To Unsubscribe:
https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus
