<!DOCTYPE html><html><head><title></title><style type="text/css">p.MsoNormal,p.MsoNoSpacing{margin:0}</style></head><body><div>I'm not Aki but hope you don't mind...<br></div><div><br></div><div>On Wed, Apr 17, 2019, at 10:42 PM, TG Servers via dovecot wrote:<br></div><blockquote type="cite" id="qt"><div><span style="font-family:Lato" class="font">Hi,<br> <br> MariaDB documentation says it accepts OpenSSL cipher strings in
its ssl_cipher parameters like ssl_cipher="TLSv1.2". <br> This is also mentioned when creating or changing users in terms of
setting this with the REQUIRE CIPHER parameter like CREATE USER
... REQUIRE CIPHER 'TLSv1.2'...<br> So this is all very nice and also working but sadly whith a
connection string from dovecot it is not working anymore.<br> If you set the user only on REQUIRE SSL, the ssl connection and
everything is working fine between dovecot and mariaDB.<br> But when you set REQUIRE CIPHER 'TLSv1.2' in mariaDB and use
ssl_cipher=TLSv1.2 in the connection string from dovecot you get
the following errors, it does not account the various ciphers of
TLSv1.2 but rather expects TLSv1.2 somehow.<br> <br> [Note] X509 ciphers mismatch: should be 'TLSv1.2' but is
'DHE-RSA-AES256-GCM-SHA384'<br> <br> A good cipher is sent but the cipher cannot be TLSv1.2 of course
:)<br> But no one will put in explicit ciphers there as this is dangerous
in my eyes, people forget updating... Also this is misbehaviour or
misdocumented.<br> The thing is now where to address this. Dovecot or MariaDB. <br> As dovecot seems to use a good cipher and MariaDB expects a
TLSv1.2 string rather than a cipher out of TLSv1.2 I would say
mariaDB but am not sure.<br> <br> Maybe Aki could say something to it, would be great.<br> <br> Thanks!<br> <br> The docs from mariaDB to this are here :<br> </span><a href="https://mariadb.com/kb/en/library/create-user/">https://mariadb.com/kb/en/library/create-user/</a></div><div> <a href="https://mariadb.com/kb/en/library/securing-connections-for-client-and-server/">https://mariadb.com/kb/en/library/securing-connections-for-client-and-server/</a><br></div></blockquote><div><br></div><div>But but but...<br></div><div><br></div><div>TLSv1.2 is not a cipher, it's a protocol.<br></div><div><br></div><div>Maria DB docs say the settings excepts a list of ciphers or a protocol name:<br></div><div><br></div><div><a href="https://mariadb.com/kb/en/library/ssltls-system-variables/#ssl_cipher">https://mariadb.com/kb/en/library/ssltls-system-variables/#ssl_cipher</a><br></div><div><br></div><div>In in other software it's common to have two distinct settings, one for protocol and one a cipher "pattern".<br></div><div><br></div><div>Maybe you could try something like this:<br></div><div><br></div><div>kECDHE+CHACHA20:kECDHE+AESGCM<br></div><div><br></div><div>ChaCha / Poly and AES GCM are TLS 1.2 + only ciphers.<br></div><div><br></div><div>This will not include AES CBC which exist with variations in both 1.0 to 1.2, but if you're security conscious, you probably don't want to use CBC anyway.<br></div><div><br></div><div>Or you could match just 1.2 versions with - I think - AESCBC+SHA384:AESCBC+SHA256. This will leave out AES CBC SHA1 which are in 1.0 - 1.1.<br></div><div><br></div><div>And now Aki can correct me :)</div><div><br></div><div>-- K<br></div><div><br></div></body></html>