Bug 1287192 - postfix is limited to using security protocols from last century
Summary: postfix is limited to using security protocols from last century
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: postfix
Version: 6.7
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: ---
Assignee: Jaroslav Škarvada
QA Contact: Andrej Dzilský
Mirek Jahoda
Depends On:
Blocks: 1269194 1355829 1253743 1310222 1356054 1359261
TreeView+ depends on / blocked
Reported: 2015-12-01 17:46 UTC by Martin Poole
Modified: 2020-05-14 15:04 UTC (History)
6 users (show)

Fixed In Version: postfix-2.6.6-8.el6
Doc Type: Enhancement
Doc Text:
_postfix_ now supports user-controlled configuration of *TLS* With this update, _postfix_ offers configuration options for more precise control of the Transport Layer Security (TLS) protocol version. For example, you can now disable *TLS* v1.1 while having *TLS* v1.2 enabled. To do this, add the following line to the `main.cf` file: smtpd_tls_mandatory_protocols = !TLSv1.1
Clone Of:
Last Closed: 2017-03-21 11:29:48 UTC
Target Upstream Version:

Attachments (Terms of Use)
Backported fix (2.69 KB, patch)
2016-06-02 14:18 UTC, Jaroslav Škarvada
no flags Details | Diff

System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:0752 normal SHIPPED_LIVE postfix bug fix update 2017-03-21 12:45:57 UTC

Description Martin Poole 2015-12-01 17:46:23 UTC
Description of problem:

postfix in RHEL6 supports TLSv1.1 & TLSv1.2 when using the more recent openssl library. Unfortunately there is no mechanism to control either of these, either as explicit or as exclusions

Version-Release number of selected component (if applicable):


Comment 2 Jaroslav Škarvada 2016-06-02 14:18:07 UTC
Created attachment 1164096 [details]
Backported fix

The fix is easy and should be harmless.

Comment 4 Jaroslav Škarvada 2016-06-02 14:19:45 UTC
Scratch build for testing:

Comment 5 Jaroslav Škarvada 2016-06-02 14:22:51 UTC
smtpd_tls_mandatory_protocols = TLSv1.2, !TLSv1, !TLSv1.1, !SSLv2, !SSLv3

And TLSv1.2 is only used if STARTTLS is initiated.

Comment 15 Andrej Dzilský 2016-12-08 16:47:56 UTC
Works :) , well done.

Comment 18 errata-xmlrpc 2017-03-21 11:29:48 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.