Re: TLS: advice on best practices

2013-09-20 Thread Viktor Dukhovni
On Fri, Sep 20, 2013 at 09:27:57AM -0500, Noel Jones wrote: > Without close cooperation from the remote site, fingerprint > verification just isn't practical. For an arbitrary third-party > site, you'll probably need to stick to "encrypt" or maybe in some > cases "verify". > http://www.postfix.org

Re: TLS: advice on best practices

2013-09-20 Thread Noel Jones
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 9/20/2013 6:36 AM, Luigi Rosa wrote: > Hi, I have a TLS enabled Postfix with a PKI certificate. > > The configuration of SMTP TLS is: > > smtp_tls_security_level = may smtp_tls_note_starttls_offer = > yes smtp_tls_fingerprint_digest = sha1 smtp_tl

TLS: advice on best practices

2013-09-20 Thread Luigi Rosa
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, I have a TLS enabled Postfix with a PKI certificate. The configuration of SMTP TLS is: smtp_tls_security_level = may smtp_tls_note_starttls_offer = yes smtp_tls_fingerprint_digest = sha1 smtp_tls_policy_maps = hash:/etc/postfix/tls_policy and in