Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Postfix 3.7+ custom DH params discouraged on OpenSSL 3 #238

Open
Tracked by #260
wolegis opened this issue Apr 9, 2024 · 1 comment · May be fixed by #256
Open
Tracked by #260

Postfix 3.7+ custom DH params discouraged on OpenSSL 3 #238

wolegis opened this issue Apr 9, 2024 · 1 comment · May be fixed by #256
Assignees
@gstrauss
Labels
compatibility Warnings, deprecations or incompatibilities to tackle enhancement New feature or request

Comments

@wolegis
Copy link

wolegis commented Apr 9, 2024 •
edited
Loading

See https://www.postfix.org/postconf.5.html section smtpd_tls_dh1024_param_file

With Postfix ≥ 3.7, built with OpenSSL version is 3.0.0 or later, if the parameter value is either empty or "auto", then the DH parameter selection is delegated to the OpenSSL library, which selects appropriate parameters based on the TLS handshake. This choice is likely to be the most interoperable with SMTP clients using various TLS libraries, and custom local parameters are no longer recommended when using Postfix ≥ 3.7 built against OpenSSL 3.0.0.
@janbrasna janbrasna changed the title postfix smtpd_tls_dh1024_param_file obsolete since 3.7 Postfix 3.7+ custom DH params discouraged on OpenSSL 3 Oct 6, 2024
@gstrauss gstrauss mentioned this issue Oct 7, 2024
Merged
gstrauss added a commit to gstrauss/ssl-config-generator that referenced this issue Oct 10, 2024
@gstrauss
Hide DH params for servers using openssl DH auto
060e92b 
openssl SSL_CTX_set_dh_auto() or SSL_set_dh_auto() interfaces support
RFC7919 Negotiated Finite Field Diffie-Hellman Ephemeral Parameters
for Transport Layer Security (TLS)

github: closes mozilla#238
@gstrauss
Copy link
Collaborator

Included in #256 is a change for Postfix 3.7+ and OpenSSL 3.0.0+

@janbrasna janbrasna added enhancement New feature or request compatibility Warnings, deprecations or incompatibilities to tackle labels Oct 10, 2024
This was referenced Oct 11, 2024
Open
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@gstrauss gstrauss

Labels
compatibility Warnings, deprecations or incompatibilities to tackle enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Updates to support OpenSSL 3.x gstrauss/ssl-config-generator
3 participants
@gstrauss @janbrasna @wolegis