On 13/04/2020 12:35 Thomas Schneider <qsx@chaotikum.eu> wrote:
Good $daytime,
as per the recommendations of Mozilla’s SSL config generator[0], I wanted to set ssl_min_protocol=TLSv1.3 in my dovecot config. This produced the error:
imap-login: Error: Failed to initialize SSL server context: Unknown ssl_min_protocol setting 'TLSv1.3'
After some digging, I found the function that parses this setting in src/lib-ssl-iostream/iostream-openssl-common.c (openssl_min_protocol_to_options()), which maps strings such as SSL_TXT_TLSV1_2 == "TLSv1.2" (from openssl/ssl.h) to the appropriate version and option defines of OpenSSL.
Said openssl/ssl.h does not contain a SSL_TXT_TLSV1_3, so it’s no surprise that dovecot does not know this setting. As a quick fix, I could probably extend struct {…} protocol_versions[] (in iostream-openssl-common.c again) with an appropriate "TLSv1.3" entry (and send a patch), though I would also suggest to OpenSSL to add a SSL_TXT_TLSV1_3 define.
Unfortunately, I have not found a config setting in dovecot to set SSL_OP_NO_TLSv1_2, or in fact any way to enforce TLS >=1.3, except maybe via the cipher list string.
I think that dovecot should support setting this, and I’d also gladly provide a patch.
Thanks, Thomas
Hi!
What version of Dovecot are you using? What OS/distro are you using?
I'm guessing you're seeing this, see https://dovecot.org/pipermail/dovecot/2019-December/117799.html
Aki