<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Hallo zusammen,</div><div class=""><br class=""></div><div class="">Ich hab inzwischen sehr viel über die SSLFehler die hier ab und an gepostet werden gelesen, verstehe es aber immer noch nicht :-/</div><div class="">Mein neuer Mailserver (Postfix 2.11.3) läuft eigentlich ganz gut, nur mit dem Thema SSL/TLS habe ich noch meine Probleme.</div><div class=""><br class=""></div><div class="">Ein Kunde hat dies vom Absender einer E-Mail bekommen:</div><div class=""><br class=""></div><div class=""><blockquote type="cite" class="">Hi. This is the qmail-send program at <a href="http://post.ze.stw.de" class="">post.ze.stw.de</a>.<br class="">I'm afraid I wasn't able to deliver your message to the following addresses.<br class="">This is a permanent error; I've given up. Sorry it didn't work out.<br class=""><br class=""><x.xxxxxxxx@heilbronn-xyz.de>:<br class="">TLS not available: connect failed: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure<br class="">I'm not going to try again; this message has been in the queue too long.<br class=""><br class="">--- Below this line is a copy of the message.<br class=""><br class="">Return-Path: <xxx.xxxxxxxx@stw.de><br class="">Received: (qmail 30379 invoked by uid 1004); 1 Mar 2017 12:01:02 -0000<br class="">Received: from 10.244.66.16 by post.ze.stw.de (envelope-from <xxx.xxxxxxxx@stw.de>, uid 82) with qmail-scanner-1.25st </blockquote><blockquote type="cite" class="">(clamdscan: 0.83/1293. spamassassin: 3.0.2. perlscan: 1.25st. <br class="">Clear:RC:1(10.244.66.16):. <br class="">Processed in 0.222746 secs); 01 Mar 2017 12:01:02 -0000<br class="">Received: from <a href="http://exchange.stw.de" class="">exchange.stw.de</a> (HELO stwmsx01.stw.local) ([10.244.66.16])<br class="">(envelope-sender <xxx.xxxxxxxx@stw.de>)</blockquote><blockquote type="cite" class="">by <a href="http://post.ze.stw.de" class="">post.ze.stw.de</a> (qmail-ldap-1.03) with SMTP</blockquote><br class=""></div><div class="">Das Postfix Log Logfile spuckt dazu folgendes aus. </div><div class="">Ähnliche Einträge habe ich auch von anderen Systemen z.B. von .<a href="http://monster.com" class="">monster.com</a>, <a href="http://registerportal.de" class="">registerportal.de</a>, etc.</div><div class=""><br class=""></div><div class=""></div><blockquote type="cite" class=""><div class="">Mar 1 12:08:48 mx1 postfix/smtpd[13562]: connect from <a href="http://gate.stw.de" class="">gate.stw.de</a>[213.61.174.210]</div><div class="">Mar 1 12:08:48 mx1 postfix/smtpd[13562]: SSL_accept error from <a href="http://gate.stw.de" class="">gate.stw.de</a>[213.61.174.210]: -1</div><div class="">Mar 1 12:08:48 mx1 postfix/smtpd[13562]: warning: TLS library problem: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher:s3_srvr.c:1440:</div><div class="">Mar 1 12:08:48 mx1 postfix/smtpd[13562]: lost connection after STARTTLS from <a href="http://gate.stw.de" class="">gate.stw.de</a>[213.61.174.210]</div><div class="">Mar 1 12:08:48 mx1 postfix/smtpd[13562]: disconnect from <a href="http://gate.stw.de" class="">gate.stw.de</a>[213.61.174.210]</div></blockquote><div class=""><br class=""></div><div class="">Ich befürchte ich habe irgendetwas in der main.cf zu heftig eingestellt.</div><div class="">Hat mir einer einen Tipp wie ich vorgehen kann?</div><div class=""><br class=""></div><div class="">Gruß Frank.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><div class=""></div></div><blockquote type="cite" class=""><div class=""># See /usr/share/postfix/main.cf.dist for a commented, more complete version</div><div class="">[…]</div></blockquote><br class=""><blockquote type="cite" class=""><div class="">smtp_dns_support_level = dnssec</div><div class="">smtp_tls_ciphers = high</div><div class="">smtp_tls_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CDB3-SHA, KRB5-DES, CBC3-SHA</div><div class="">smtp_tls_fingerprint_digest = SHA256</div><div class="">smtp_tls_mandatory_ciphers= high</div><div class="">smtp_tls_mandatory_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CDB3-SHA, KRB5-DES, CBC3-SHA</div><div class="">smtp_tls_mandatory_protocols = !SSLv2,!SSLv3</div><div class="">smtp_tls_note_starttls_offer = yes</div><div class="">smtp_tls_protocols = !SSLv2, !SSLv3</div><div class="">smtp_tls_security_level = dane</div><div class=""><br class=""></div><div class="">smtpd_tls_ciphers = high</div><div class="">smtpd_tls_dh1024_param_file = ${config_directory}/dh4096.pem</div><div class="">smtpd_tls_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CDB3-SHA, KRB5-DES, CBC3-SHA</div><div class="">smtpd_tls_fingerprint_digest = SHA256</div><div class="">smtpd_tls_mandatory_ciphers= high</div><div class="">smtpd_tls_mandatory_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CDB3-SHA, KRB5-DES, CBC3-SHA</div><div class="">smtpd_tls_mandatory_protocols = !SSLv2,!SSLv3</div><div class="">smtpd_tls_protocols = !SSLv2,!SSLv3</div><div class="">smtpd_tls_received_header = yes</div><div class="">smtpd_tls_security_level = may</div><div class=""><br class=""></div><div class="">smtpd_tls_cert_file = /etc/ssl/certs/server.crt</div><div class="">smtpd_tls_key_file = /etc/ssl/private/server.key</div></blockquote><blockquote type="cite" class=""><div class=""><br class=""></div><div class="">smtpd_sasl_type = dovecot</div><div class="">smtpd_sasl_path = private/auth</div><div class="">smtpd_sasl_auth_enable = yes</div><div class=""><br class=""></div><div class="">smtpd_recipient_restrictions =</div><div class=""> permit_mynetworks,</div><div class=""> permit_sasl_authenticated,</div><div class=""> check_sender_access hash:/etc/postfix/check_sender,</div><div class=""> check_client_access hash:/etc/postfix/check_client,</div><div class=""> reject_unauth_destination,</div><div class=""> # check_policy_service unix:private/policy-spf,</div><div class=""> reject_non_fqdn_sender,</div><div class=""> reject_non_fqdn_recipient,</div><div class=""> reject_unknown_recipient_domain,</div><div class=""> reject_invalid_hostname,</div><div class=""> reject_unknown_hostname,</div><div class=""> reject_unauth_pipelining,</div><div class=""> reject_rbl_client <a href="http://bl.spamcop.net" class="">bl.spamcop.net</a>,</div><div class=""> reject_rbl_client <a href="http://zen.spamhaus.org" class="">zen.spamhaus.org</a>,</div><div class=""> reject_rbl_client <a href="http://cbl.abuseat.org" class="">cbl.abuseat.org</a>,</div><div class=""> check_policy_service inet:127.0.0.1:12525,</div><div class=""> permit</div></blockquote><div class=""><br class=""></div><div class=""><br class=""></div></body></html>