<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<font face="Lato">short and clear :) thanks... I was also heading
into this direction and will get to them with this issue</font><br>
<br>
<div class="moz-cite-prefix">On 18/04/2019 08:20, Aki Tuomi via
dovecot wrote:<br>
</div>
<blockquote type="cite"
cite="mid:2d458512-f4f2-2836-4371-51d307029a73@open-xchange.com">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<p><br>
</p>
<div class="moz-cite-prefix">On 17.4.2019 23.00, Kostya Vasilyev
via dovecot wrote:<br>
</div>
<blockquote type="cite"
cite="mid:3bf08a0e-8dcc-4745-b974-554e59915e9b@www.fastmail.com">
<meta http-equiv="content-type" content="text/html;
charset=UTF-8">
<title></title>
<style type="text/css">p.MsoNormal,p.MsoNoSpacing{margin:0}</style>
<div>I'm not Aki but hope you don't mind...<br>
</div>
<div><br>
</div>
<div>On Wed, Apr 17, 2019, at 10:42 PM, TG Servers via dovecot
wrote:<br>
</div>
<blockquote type="cite" id="qt">
<div><span style="font-family:Lato" class="font">Hi,<br>
<br>
MariaDB documentation says it accepts OpenSSL cipher
strings in its ssl_cipher parameters like
ssl_cipher="TLSv1.2". <br>
This is also mentioned when creating or changing users in
terms of setting this with the REQUIRE CIPHER parameter
like CREATE USER ... REQUIRE CIPHER 'TLSv1.2'...<br>
So this is all very nice and also working but sadly whith
a connection string from dovecot it is not working
anymore.<br>
If you set the user only on REQUIRE SSL, the ssl
connection and everything is working fine between dovecot
and mariaDB.<br>
But when you set REQUIRE CIPHER 'TLSv1.2' in mariaDB and
use ssl_cipher=TLSv1.2 in the connection string from
dovecot you get the following errors, it does not account
the various ciphers of TLSv1.2 but rather expects TLSv1.2
somehow.<br>
<br>
[Note] X509 ciphers mismatch: should be 'TLSv1.2' but is
'DHE-RSA-AES256-GCM-SHA384'<br>
<br>
A good cipher is sent but the cipher cannot be TLSv1.2 of
course :)<br>
But no one will put in explicit ciphers there as this is
dangerous in my eyes, people forget updating... Also this
is misbehaviour or misdocumented.<br>
The thing is now where to address this. Dovecot or
MariaDB. <br>
As dovecot seems to use a good cipher and MariaDB expects
a TLSv1.2 string rather than a cipher out of TLSv1.2 I
would say mariaDB but am not sure.<br>
<br>
Maybe Aki could say something to it, would be great.<br>
<br>
Thanks!<br>
<br>
The docs from mariaDB to this are here :<br>
</span><a
href="https://mariadb.com/kb/en/library/create-user/"
moz-do-not-send="true">https://mariadb.com/kb/en/library/create-user/</a></div>
<div> <a
href="https://mariadb.com/kb/en/library/securing-connections-for-client-and-server/"
moz-do-not-send="true">https://mariadb.com/kb/en/library/securing-connections-for-client-and-server/</a><br>
</div>
</blockquote>
<div><br>
</div>
<div>But but but...<br>
</div>
<div><br>
</div>
<div>TLSv1.2 is not a cipher, it's a protocol.<br>
</div>
<div><br>
</div>
<div>Maria DB docs say the settings excepts a list of ciphers or
a protocol name:<br>
</div>
<div><br>
</div>
<div><a
href="https://mariadb.com/kb/en/library/ssltls-system-variables/#ssl_cipher"
moz-do-not-send="true">https://mariadb.com/kb/en/library/ssltls-system-variables/#ssl_cipher</a><br>
</div>
<div><br>
</div>
<div>In in other software it's common to have two distinct
settings, one for protocol and one a cipher "pattern".<br>
</div>
<div><br>
</div>
<div>Maybe you could try something like this:<br>
</div>
<div><br>
</div>
<div>kECDHE+CHACHA20:kECDHE+AESGCM<br>
</div>
<div><br>
</div>
<div>ChaCha / Poly and AES GCM are TLS 1.2 + only ciphers.<br>
</div>
<div><br>
</div>
<div>This will not include AES CBC which exist with variations
in both 1.0 to 1.2, but if you're security conscious, you
probably don't want to use CBC anyway.<br>
</div>
<div><br>
</div>
<div>Or you could match just 1.2 versions with - I think -
AESCBC+SHA384:AESCBC+SHA256. This will leave out AES CBC SHA1
which are in 1.0 - 1.1.<br>
</div>
<div><br>
</div>
<div>And now Aki can correct me :)</div>
<div><br>
</div>
<div>-- K<br>
</div>
<div><br>
</div>
</blockquote>
<br>
<p>All I'm going to say is that this is 100% mysql/mariadb issue.</p>
<p>Aki<br>
</p>
</blockquote>
<br>
</body>
</html>