Problems with port 993 (SSL)

[Stefan Suurmeijer]

On 2-9-2015 12:56, Paul van der Vlis wrote:
> Op 02-09-15 om 01:36 schreef Stefan Suurmeijer:
> From the OSX v10.11 release notes (released 15-8):
>
>   * DHE_RSA cipher suites are now disabled by default in Secure
>     Transport for TLS clients. This may cause a failure to connect to
>     TLS servers that only support DHE_RSA cipher suites. Applications
>     that explicitly enable cipher suites using SSLSetEnabledCiphers()
>     are not affected. Safari may display a “Safari can’t establish a
>     secure connection to the server” error page. Safari and other
>     clients of CFNetwork API (NSURLSession, NSURLConnection,
>     CFHTTPStream, CFSocketStream and Cocoa equivalent) will show a
>     “CFNetwork SSLHandshake failed” error in Console.
>
>
> Maybe you can use checktls.com to find out which cipher your site uses.
> A very useful site.
> Interesting site, but I need more time to understand the tests.
>
> When I use openssl, I get a long timeout after "CONNECTED", and then
> something what looklikes there is no certificate available at all:
> -----------------
> paul at server2:~$ openssl s_client -connect mail.vandervlis.nl:993
> CONNECTED(00000003)
> write:errno=104
> ---
> no peer certificate available
> ---
> No client certificate CA names sent
> ---
> SSL handshake has read 0 bytes and written 295 bytes
> ---
> New, (NONE), Cipher is (NONE)
> Secure Renegotiation IS NOT supported
> Compression: NONE
> Expansion: NONE
> ---
> paul at server2:~$
> -----------------
>
> Port 465 (postfix SSL/TLS) has the same problem.
>
> When I use openssl to port 443 what uses the same certificate,
> everything is fine. But TLSv1 with DHE-RSA-AES256-SHA cipher is used.
> I am using a SHA256 certificate with a 2048 bit public key.

If that cipher is used on port 993 as well, then probably connecting
from an Apple OSX machine won't work (I assume that is what you're
testing?), since Apple no longer allows DHE-RSA, as stated above. But
connecting from an Apple machine to port 443 using the same cipher//does
work? Maybe because you're using the SSLCipherSuite option in your
Apache config? From the release notes, that might not be affected
("Applications that explicitly enable cipher suites using
SSLSetEnabledCiphers() are not affected")
> Realize that this has worked for a long time, and so far I know I did
> not change anything.
>
> On my new mailserver port 993 (Cyrus 2.4.17) works fine with the same
> certificate. (Only tested with openssl.)

What cipher does that one use? The certificate isn't the problem I
think, the cipher you use probably is.

>
>> If your site uses a DHE-RSA cipher, you may need to change the
>> tls_cipher_list in your imapd.conf
> I only accept TLSv1 high-security ciphers:
> tls_cipher_list: TLSv1+HIGH:!aNULL:@STRENGTH

Hm, I don't know if that would allow DHE-RSA, maybe someone from Horde
knows that

KR
Stefan

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.andrew.cmu.edu/pipermail/info-cyrus/attachments/20150902/9a6325bb/attachment-0001.html