Qpsmtpd:tls

Qpsmtpd#Plugins

NAME

tls - plugin to support STARTTLS

SYNOPSIS

1. in config/plugins

tls [cert_path priv_key_path ca_path dhparam_path]

cert_path

Path to the server certificate file. Default: ssl/qpsmtpd-server.crt

priv_key_path

Path to the private key file. Default: ssl/qpsmtpd-server.key

ca_path

Path to the certificate authority file. Default: ssl/qpsmtpd-ca.crt

dhparam_path

Path to the DH parameter file if you want Diffie-Hellman key exchange. Default: ssl/qpsmtpd-dhparam.pem

DESCRIPTION

This plugin implements basic TLS support. It can also be used to support port 465 (SMTP over SSL), but only with qpsmtpd-forkserver. In this case, be sure to load plugins/tls before any other connect plugins and start qpsmtpd like this:

  qpsmtpd-forkserver --port 25 --port 465

You can also specify multiple --listen-address options as well; see the help for qpsmtpd-forkserver for more details.

If TLS is successfully negotiated then the tls_enabled field in the Connection notes is set. If you wish to make TLS mandatory you should check that field and take appropriate action. Note that you can only do that from MAIL FROM onwards.

Use the script plugins/tls_cert to automatically generate a self-signed certificate with the appropriate characteristics. Otherwise, you should give absolute pathnames to the certificate, key, and the CA root cert used to sign that certificate.

CIPHERS and COMPATIBILITY

By default, we use only the plugins that openssl considers to be "high security". If you need to tweak the available ciphers for some broken client (such as Versamail 3.x), have a look at the available ciphers at http://www.openssl.org/docs/apps/ciphers.html#CIPHER_STRINGS, and put a suitable string in config/tls_ciphers (e.g. "DEFAULT" or "HIGH:MEDIUM")

SSL/TLS protocols versions

By default, SSLv2 and SSLv3 are not accepted, leaving only TLSv1, TLSv1.1 or TLSv1.2 enabled. You can customize this in config/tls_protocols For example, this will also disabled TLSv1, leaving only TLSv1.1 and TLSv1.2

SSLv23:!SSLv2:!SSLv3:!TLSv1

---