Currently my cipher list looks as follows:
tls_high_cipherlist =
ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA:ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
When I send an email (submission) from Thunderbird the logs show:
postfix/submission/smtpd[77780]: Anonymous TLS connection established
from machine.domain.com[192.168.14.120]: TLSv1.2 with cipher
ECDHE-ECDSA-AES128-SHA (128/128 bits)
So from a client point of view it looks good...although can you get
256/256 bits rather than 128/128 bits rather?
What I would still like to test is receiving an email from another MTA
that supports an ECDSA cert to my server.
Thanks so much for the helpful advice.
On 13/05/2014 15:18, Viktor Dukhovni wrote:
On Tue, May 13, 2014 at 08:22:46AM +0100, SW wrote:
Since you're controlling the server, all you need to do is configure
a client that, all else being equal, prefers ECDSA to RSA. With
OpenSSL 1.0.0 or greater, a cipherlist something like:
aRSA:-aRSA:aECDSA:-aECDSA:kRSA:-kRSA:kEDH:-kEDH:kEECDH:-kEECDH:AESGCM:-AESGCM:AES128:CAMELLIA128:3DES:RC4:!EXPORT:!LOW:!MD5:!aNULL:!aDSS:!kSRP:!aPSK:!aECDH
will give you 128-bit AES and CAMELLIA, followed by 3DES and 128-bit
RC4, with ECDSA preferred to RSA, kEECDH and KEDH preferred to RSA
key transport, and AESGCM preferred to other block cipher modes.
