sslv3 alert handshake failure #62
Description
Hi, @aeris
Currently testing SMTP TLS encryption with Cryptcheck. https://cryptcheck.fr/smtp/dhautefeuille.eu
I am getting an error:
Erreur durant l’analyse : SSL_connect returned=1 errno=0 state=SSLv3 read server hello A: sslv3 alert handshake failure
Not sure why since everything seems correct.
Not sure if the time is correct on Cryptcheck service as well?
Any required logs or conf to submit (postfix, dovecot, openssl, ssldump...)?
➜ postconf mail_version
mail_version = 3.8.1
➜ dovecot --version
2.3.20 (80a5ac675d)
➜ openssl version
OpenSSL 3.1.1 30 May 2023 (Library: OpenSSL 3.1.1 30 May 2023)
➜ certbot --version
certbot 2.6.0
Using the latest versions available of these packages on Arch Linux.
Some of the postfix conf. I have:
# Smtp ( OUTGOING / Client )
smtp_tls_loglevel = 2
smtp_tls_security_level = may
smtp_tls_CApath = /etc/ssl/certs
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtp_tls_mandatory_ciphers = high
smtp_tls_exclude_ciphers = aNULL, eNULL, EXPORT, DES, 3DES, RC2, RC4, MD5, PSK, SRP, DSS, AECDH, ADH
smtp_tls_note_starttls_offer = yes
# ---------------------------------------------------------------------------------------------------
# Smtpd ( INCOMING / Server )
smtpd_tls_loglevel = 2
smtpd_tls_auth_only = yes
smtpd_tls_security_level = may
smtpd_tls_received_header = yes
smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_mandatory_ciphers = high
smtpd_tls_eecdh_grade = strong
smtpd_tls_exclude_ciphers = EXP, LOW, MEDIUM, aNULL, eNULL, SRP, PSK, kDH, DH, kRSA, DHE, DSS, RC4, DES, IDEA, SEED, ARIA, CAMELLIA, AESCCM8, 3DES, MD5, SHA
smtpd_tls_CApath = /etc/ssl/certs
smtpd_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
smtpd_tls_dh1024_param_file = /etc/postfix/dhparams/4096/dh.pem
smtpd_tls_chain_files =
/etc/letsencrypt/live/arch-server.dhautefeuille.eu/privkey.pem
/etc/letsencrypt/live/arch-server.dhautefeuille.eu/fullchain.pem
tls_server_sni_maps = hash:/etc/postfix/sni.map
tls_preempt_cipherlist = yes
tls_random_source = dev:/dev/urandom
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
lmtp_tls_session_cache_database = btree:${data_directory}/lmtp_scache
And for Dovecot:
ssl_min_protocol = TLSv1.2
ssl_cipher_list = ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
ssl_prefer_server_ciphers = yes
ssl_dh = </etc/dovecot/dhparams/4096/dh.pem
The whole Mail SNI is set up.