postfix: Require TLSv1.2 or later and Mozilla's “modern” cipherlist

hashbang · Nov 22, 2017 · 67567eb · 67567eb
1 parent 027fa39
commit 67567eb
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/postfix/main.cf b/postfix/main.cf
@@ -14,9 +14,10 @@ relayhost                       = mail.$mydomain
 smtp_tls_security_level         = secure
 smtp_tls_CAfile                 = /etc/ssl/certs/ca-certificates.crt
 smtp_tls_fingerprint_digest     = sha1
-smtp_tls_mandatory_protocols    = !SSLv2, !SSLv3, !TLSv1
+smtp_tls_mandatory_protocols    = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1
+smtp_tls_protocols              = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1
 smtp_tls_exclude_ciphers        = NULL, MD5, DES, RC4
-smtp_tls_mandatory_ciphers      = high
+smtp_tls_mandatory_ciphers      = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
 
 # TLS Settings
 smtpd_use_tls                    = yes