mirror of
https://github.com/internetstandards/toolbox-wiki.git
synced 2026-07-21 11:37:40 +02:00
Wouter Kobes
78 lines
2.3 KiB
Markdown
78 lines
2.3 KiB
Markdown
<img align="right" src="/images/logo-internetnl-en.svg">
|
|
|
|
# UNDER CONSTRUCTION!!!
|
|
|
|
# STARTTLS how-to
|
|
This how-to is created by the Dutch Internet Standards Platform (the organization behind [internet.nl](https://internet.nl)) and is meant to provide practical information and guidance on implementing STARTTLS.
|
|
|
|
# Table of contents
|
|
Under construction
|
|
|
|
# What is STARTTLS?
|
|
Under construction
|
|
|
|
# Why use STARTTLS?
|
|
Under construction
|
|
|
|
# Tips, tricks and notices for implementation
|
|
|
|
* Use the RFC 7919 defined DH groups: https://raw.githubusercontent.com/internetstandards/dhe_groups/main/ffdhe4096.pem)
|
|
|
|
## Implementing STARTTLS in Postfix
|
|
**Specifics for this setup**
|
|
* Ubuntu 24.04
|
|
* Postfix 3.10.x
|
|
* OpenSSL 3.0.3
|
|
|
|
**Assumptions**
|
|
* Mail server is using DANE
|
|
* Software packages are already installed
|
|
|
|
### Configuring Postfix
|
|
|
|
/etc/postfix/main.cf
|
|
|
|
tls_high_cipherlist = ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-CCM:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-CCM:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256
|
|
tls_config_name = postfix
|
|
tls_preempt_cipherlist = yes
|
|
|
|
smtpd_tls_cert_file=...
|
|
smtpd_tls_key_file=...
|
|
smtpd_tls_security_level=may
|
|
smtpd_tls_auth_only=yes
|
|
smtpd_tls_protocols = >=TLSv1.2
|
|
smtpd_tls_mandatory_protocols = >=TLSv1.2
|
|
smtpd_tls_ciphers = high
|
|
smtpd_tls_mandatory_ciphers = high
|
|
smtpd_tls_loglevel = 1
|
|
smtpd_tls_session_cache_database = btree:/var/lib/postfix/smtpd_tls_session_cache
|
|
smtpd_tls_received_header = yes
|
|
|
|
smtp_tls_note_starttls_offer = yes
|
|
smtp_tls_protocols = >=TLSv1.2
|
|
smtp_tls_mandatory_protocols = >=TLSv1.2
|
|
smtp_tls_ciphers = high
|
|
smtp_tls_mandatory_ciphers = high
|
|
smtp_tls_loglevel = 1
|
|
smtp_tls_session_cache_database = btree:/var/lib/postfix/smtp_tls_session_cache
|
|
smtp_dns_support_level = dnssec
|
|
smtp_tls_security_level = dane
|
|
|
|
|
|
/etc/ssl/openssl.cnf
|
|
|
|
postfix = postfix_settings
|
|
....
|
|
[postfix_settings]
|
|
ssl_conf = postfix_ssl_settings
|
|
[postfix_ssl_settings]
|
|
system_default = baseline_postfix_settings
|
|
[baseline_postfix_settings]
|
|
SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA512:RSA+SHA256:RSA+SHA384
|
|
|
|
|
|
To enable PQC:
|
|
|
|
tls_eecdh_auto_curves =
|
|
tls_ffdhe_auto_groups =
|