<html aria-label="message body"><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Hallo Timm,<div><br></div><div><div>Der Renault-/IronPort-Server bietet ausschließlich RSA-basierte TLS-Cipher an, z. B.:</div><div><br></div><div>ECDHE-RSA-*</div><div>DHE-RSA-*</div><div>AES*-RSA-*</div><div><br></div><div>Dein Mailserver bietet dagegen aktuell praktisch nur ECDSA-basierte Cipher an:</div><div><br></div><div>ECDHE-ECDSA-*</div></div><div><br></div><div>Ist das beabsichtigt? Lösung wäre, zusätzlich ein RSA-Zertifikat bzw. RSA-Cipher für Postfix bereitzustellen.</div><div><br></div><div>VG</div><div><br id="lineBreakAtBeginningOfMessage"><div><div dir="auto" style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Florian</div></div></div><div>
</div>
<div><br><blockquote type="cite"><div>On 20. May 2026, at 21:57, Timm Schneider via Postfixbuch-users <postfixbuch-users@listen.jpberlin.de> wrote:</div><br class="Apple-interchange-newline"><div><div>Hallo Ralf<br><br><br>Das hat mir ein tlstest rausgegeben:<br><br>rDNS (194.165.192.44): esa.hc1506-8.eu.iphmx.com.<br> Service set: STARTTLS via SMTP<br> Testing ciphers per protocol via OpenSSL plus sockets against the server, ordered by encryption strength<br><br>Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)<br>-----------------------------------------------------------------------------------------------------------------------------<br>SSLv2<br>SSLv3<br>TLS 1<br>TLS 1.1<br>TLS 1.2<br> xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384<br> xc028 ECDHE-RSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384<br> x9f DHE-RSA-AES256-GCM-SHA384 DH 2048 AESGCM 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384<br> xcca8 ECDHE-RSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256<br> xccaa DHE-RSA-CHACHA20-POLY1305 DH 2048 ChaCha20 256 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256<br> x6b DHE-RSA-AES256-SHA256 DH 2048 AES 256 TLS_DHE_RSA_WITH_AES_256_CBC_SHA256<br> xc077 ECDHE-RSA-CAMELLIA256-SHA384 ECDH 253 Camellia 256 TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384<br> xc4 DHE-RSA-CAMELLIA256-SHA256 DH 2048 Camellia 256 TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256<br> x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384<br> xc09d AES256-CCM RSA AESCCM 256 TLS_RSA_WITH_AES_256_CCM<br> x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256<br> xc0 CAMELLIA256-SHA256 RSA Camellia 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256<br> xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256<br> xc027 ECDHE-RSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256<br> x9e DHE-RSA-AES128-GCM-SHA256 DH 2048 AESGCM 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256<br> xc09c AES128-CCM RSA AESCCM 128 TLS_RSA_WITH_AES_128_CCM<br> x67 DHE-RSA-AES128-SHA256 DH 2048 AES 128 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256<br> xc076 ECDHE-RSA-CAMELLIA128-SHA256 ECDH 253 Camellia 128 TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256<br> xbe DHE-RSA-CAMELLIA128-SHA256 DH 2048 Camellia 128 TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256<br> x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256<br> x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256<br> xba CAMELLIA128-SHA256 RSA Camellia 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256<br>TLS 1.3<br><br>und Meiner:<br><br> rDNS (83.137.45.114): ns.tms-it.net.<br> Service set: STARTTLS via SMTP<br><br> Testing ciphers per protocol via OpenSSL plus sockets against the server, ordered by encryption strength<br><br>Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)<br>-----------------------------------------------------------------------------------------------------------------------------<br>SSLv2<br>SSLv3<br>TLS 1<br>TLS 1.1<br>TLS 1.2<br> xc02c ECDHE-ECDSA-AES256-GCM-SHA384 ECDH 253 AESGCM 256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384<br> xc024 ECDHE-ECDSA-AES256-SHA384 ECDH 253 AES 256 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384<br> xc00a ECDHE-ECDSA-AES256-SHA ECDH 253 AES 256 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA<br> xcca9 ECDHE-ECDSA-CHACHA20-POLY1305 ECDH 253 ChaCha20 256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256<br> xc0af ECDHE-ECDSA-AES256-CCM8 ECDH 253 AESCCM8 256 TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8<br> xc0ad ECDHE-ECDSA-AES256-CCM ECDH 253 AESCCM 256 TLS_ECDHE_ECDSA_WITH_AES_256_CCM<br> xc073 ECDHE-ECDSA-CAMELLIA256-SHA384 ECDH 253 Camellia 256 TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384<br> xc019 AECDH-AES256-SHA ECDH 521 AES 256 TLS_ECDH_anon_WITH_AES_256_CBC_SHA<br> xa7 ADH-AES256-GCM-SHA384 DH 3072 AESGCM 256 TLS_DH_anon_WITH_AES_256_GCM_SHA384<br> x6d ADH-AES256-SHA256 DH 3072 AES 256 TLS_DH_anon_WITH_AES_256_CBC_SHA256<br> x3a ADH-AES256-SHA DH 3072 AES 256 TLS_DH_anon_WITH_AES_256_CBC_SHA<br> xc5 ADH-CAMELLIA256-SHA256 DH 3072 Camellia 256 TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256<br> x89 ADH-CAMELLIA256-SHA DH 3072 Camellia 256 TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA<br> xc05d ECDHE-ECDSA-ARIA256-GCM-SHA384 ECDH 253 ARIAGCM 256 TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384<br> xc02b ECDHE-ECDSA-AES128-GCM-SHA256 ECDH 253 AESGCM 128 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256<br> xc023 ECDHE-ECDSA-AES128-SHA256 ECDH 253 AES 128 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256<br> xc009 ECDHE-ECDSA-AES128-SHA ECDH 253 AES 128 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA<br> xc0ae ECDHE-ECDSA-AES128-CCM8 ECDH 253 AESCCM8 128 TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8<br> xc0ac ECDHE-ECDSA-AES128-CCM ECDH 253 AESCCM 128 TLS_ECDHE_ECDSA_WITH_AES_128_CCM<br> xc072 ECDHE-ECDSA-CAMELLIA128-SHA256 ECDH 253 Camellia 128 TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256<br> xc018 AECDH-AES128-SHA ECDH 521 AES 128 TLS_ECDH_anon_WITH_AES_128_CBC_SHA<br> xa6 ADH-AES128-GCM-SHA256 DH 1024 AESGCM 128 TLS_DH_anon_WITH_AES_128_GCM_SHA256<br> x6c ADH-AES128-SHA256 DH 1024 AES 128 TLS_DH_anon_WITH_AES_128_CBC_SHA256<br> x34 ADH-AES128-SHA DH 1024 AES 128 TLS_DH_anon_WITH_AES_128_CBC_SHA<br> xbf ADH-CAMELLIA128-SHA256 DH 1024 Camellia 128 TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256<br> x46 ADH-CAMELLIA128-SHA DH 1024 Camellia 128 TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA<br> xc05c ECDHE-ECDSA-ARIA128-GCM-SHA256 ECDH 253 ARIAGCM 128 TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256<br>TLS 1.3<br> x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384<br> x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256<br> x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256<br><br> Done 2026-05-20 21:31:55 [ 17s] -->> 83.137.45.114:25 (mail.tms-itdienst.at) <<--<br><br><br><br><br>Am 20.05.2026 um 21:37 schrieb Ralf Hildebrandt via Postfixbuch-users:<br><blockquote type="cite">* Timm Schneider via Postfixbuch-users <postfixbuch-users@listen.jpberlin.de>:<br><blockquote type="cite">Hallo nochmal.<br><br>Welche cipher nutzt den Postfix, wenn nichts definiert ist?<br></blockquote>postconf smtpd_tls_ciphers<br><br>da kommt bei mir "medium" raus, dann fragt man sich: "Medium? Mit wenig Blubber?"<br><br>postconf tls_medium_cipherlist<br>sagt dann WAS das " medium" bedeutet -- da kommt bei mir raus:<br><br>tls_medium_cipherlist = aNULL:-aNULL:HIGH:MEDIUM:!SEED:!IDEA:!3DES:!RC2:!RC4:!RC5:!kDH:!kECDH:!aDSS:!MD5:+RC4:@STRENGTH<br><br>Das ist dann natürlich OpenSLL-Sprech. Und welche das konkret sind sagt dir dann ein:<br>openssl ciphers -v 'aNULL:-aNULL:HIGH:MEDIUM:!SEED:!IDEA:!3DES:!RC2:!RC4:!RC5:!kDH:!kECDH:!aDSS:!MD5:+RC4:@STRENGTH'<br><br>TLS_AES_256_GCM_SHA384 TLSv1.3 Kx=any Au=any Enc=AESGCM(256) Mac=AEAD<br>TLS_CHACHA20_POLY1305_SHA256 TLSv1.3 Kx=any Au=any Enc=CHACHA20/POLY1305(256) Mac=AEAD<br>TLS_AES_128_GCM_SHA256 TLSv1.3 Kx=any Au=any Enc=AESGCM(128) Mac=AEAD<br>...<br><br></blockquote><br>-- <br>Timm Schneider<br>4840 Vöcklabruck<br>T. (AT) 0720.501078<br>T. (DE) 089.2441 3327<br>T. (CH) 032.510 9875<br>T. (IT) 366.908 0087<br><br>Video-Konferenz mit mir: https://tmspbx.3cx.at/meet/timmschneider<br><br></div></div></blockquote></div><br></body></html>