<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body><div>ssl_dh=</path/to/dh.pem</div><div><br></div><div>put it under /etc/dovecot?</div><div><br></div><div><br></div><div><br></div><div id="composer_signature"><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">---<div>Aki Tuomi</div><div>Dovecot oy</div></div><div><br></div><div style="font-size:100%;color:#000000"><!-- originalMessage --><div>-------- Original message --------</div><div>From: tai74@vfemail.net </div><div>Date: 25/06/2018 19:48 (GMT+02:00) </div><div>To: dovecot@dovecot.org </div><div>Subject: Re: upgrade 2.2 to 2.3, diffie-hellman, ssl_min_protocol </div><div><br></div></div>Thanks Joseph, Aki, but something missing from upgrade document, where <br>does the dh param file go? I located ssl-parameters.dat so I will put <br>it there.<br><br>Quoting Joseph Tam <jtam.home@gmail.com>:<br><br>> On Fri, 22 Jun 2018, Joseph Tam wrote:<br>><br>>> However, recent advances make this condition obsolete [*] and not<br>>> really safer, so a much faster way to generate a DH key is<br>>><br>>> openssl dhparam -dsaparam -out dh.pem 4096<br>>><br>>> DH generation is a one time operation, so if you're paranoid and you've<br>>> got time to burn, go ahead and generate the "safe" DH key.<br>>><br>>> [*] https://security.stackexchange.com/questions/42415/openvpn-dhparam)<br>><br>> Oh, I might have to backtrack on this claim<br>><br>> https://www.openssl.org/news/secadv/20160128.txt<br>><br>> although it's beyond my understanding whether it's applicable to Dovecot.<br>><br>> Joseph Tam <jtam.home@gmail.com><br><br><br><br><br>-------------------------------------------------<br><br>ONLY AT VFEmail! - Use our Metadata Mitigator to keep your email out of the NSA's hands!<br>$24.95 ONETIME Lifetime accounts with Privacy Features! <br>15GB disk! No bandwidth quotas!<br>Commercial and Bulk Mail Options! <br></body></html>