I want to configure my new mail server secure as possible and wondering about the used cipher while connecting to Googles SMTP server.
I'm curious why they prefer the cipher
ECDHE-RSA-AES256-GCM-SHA384? Isn't this weaker?
When I test with
openssl s_client -connect gmail-smtp-in.l.google.com:25 -starttls smtp -cipher ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256 the connection negotiates with cipher
If I present only cipher
ECDHE-RSA-AES256-GCM-SHA384 to the server it uses them.
The most important question: is there a way to force postfix to use only the strongest cipher? If I exclude AES128 via tls_policy it gets even worse!