<!doctype html>
<html>
<head>
<meta charset="UTF-8">
</head>
<body>
<div>
<br>
</div>
<blockquote type="cite">
<div>
On 10/05/2020 02:18 Steve Egbert <<a href="mailto:s.egbert@sbcglobal.net">s.egbert@sbcglobal.net</a>> wrote:
</div>
<div>
<br>
</div>
<div>
<br>
</div>
<div>
>> I have an operational need to disable TLSv1.3 due to inadequate support to exclude certain ciphers.
</div>
<blockquote type="cite">
<div>
There is no need to disable TLSv1.3 and attempts to do so will be flagged as “downgrade attacks”.
</div>
</blockquote>
<div>
Let us ignore TLSv1.2 as a downgrade option. And focus on TLSv1.3 for
</div>
<div>
its entirety of this thread.
</div>
<div>
<br>
</div>
<div>
If the ciphersuite (not cipher for that's a TLSv1.2 term), but a
</div>
<div>
ciphersuite for TLSv1.3.... needs to have its set of ciphers:
</div>
<div>
<br>
</div>
<div>
* Reordered, or
</div>
<div>
* disabled
</div>
<div>
<br>
</div>
<div>
We cannot do it at the moment given this snapshot of Dovecot.
</div>
</blockquote>
<div>
<br>
</div>
<div>
Hi!
</div>
<div>
<br>
</div>
<div>
We are working for adding extra controls for TLSv1.3 (e.g. controlling cipher suitea) and ability to set ssl_max_version.
</div>
<div>
<br>
</div>
<div>
Cannot promise a date yet.
</div>
<div>
---
</div>
<div>
Aki
</div>
<div>
<br>
</div>
<div>
<br>
</div>
<div>
<br>
</div>
<div>
<br>
</div>
<div>
<br>
</div>
<div>
<br>
</div>
<div>
<br>
</div>
<div class="io-ox-signature">
<pre>---
Aki Tuomi</pre>
</div>
</body>
</html>