0

Having a bit of an issue with a SPAM filter receiving incoming emails. I was recently notified by a client that emails had been bouncing back when trying to contact me following disabling RC4, SSLv2 & SSLv3.

The bounce back they've had is as follows.

Message delivery to '[email protected]' delayed SMTP module(domain somedomain.com) reports: connection with mail.somedomain.com is broken

In past communications I can see the following in the message header.

version=TLS1_1 cipher=ECDHE-RSA-AES128-SHA bits=128/128

In speaking with our support network, I've been informed that by disabling SSLv3 it also disables TLS 1.0, and TLS 1.1 because they shared the same ciphers. Our client doesn't appear to be using TLS 1.2, and in prior communications I can see that they connect using TLS 1.1 which explains why their mail isn't getting through.

I can understand TLS 1.0 not being used, but I thought TLS 1.1 was still secure and wasn't aware that SSLv3 would have a direct impact on it?

Any help would be appreciated.

Improve this question

1 Answer 1

Reset to default
2

I've been informed that by disabling SSLv3 it also disables TLS 1.0, and TLS 1.1 because they shared the same ciphers.

This is wrong.
There is a difference between disabling a TLS protocol version and disabling ciphers. But, a common error is actually that someone tries to disable the use of SSLv3 by disabling all ciphers which were defined for SSLv3 and up instead of just disabling the TLS protocol version. Also, there is actually software out there which does not allow to disable SSL protocol versions but only restrict ciphers.

For example with the mail server Postfix there are various options for allowing or restricting ciphers (smtpd_tls_mandatory_ciphers, smtpd_tls_mandatory_exclude_ciphers) but also options to allow or restrict TLS protocol versions (smtpd_tls_mandatory_protocols). Only the last should be used to restrict the protocol version.

Improve this answer
5
  • Thanks for the reply. I'm going back to the supplier to ask questions as to why the options he's given me have disabled TLS 1.1 when I don't think it should have. The options I've got here are to disable protocol versions, yet that seems to be working on the ciphers as well.
    – Joey Bob
    Sep 15, 2017 at 10:58
  • @JoeyBob: it would be interesting to see what the supplier actually gave you as options and for which kind of mail server.
    – Steffen Ullrich
    Sep 15, 2017 at 13:06
  • I've had a response. I've been told that most companies don't accept SSLv3, TLS 1.0 and TLS 1.1 as they are not considered "secured". The options I was given were to disble weak ciphers (which I have done), to disable SSLv3 (which I've opted for), and only other option is to disabled RC4, SSLv2, & SSLv3 ciphers. I've got no other options from them. The SPAM filter, is one provided from a large supplier, but it proprietary so I have no idea what's happening under the hood.
    – Joey Bob
    Sep 15, 2017 at 14:02
  • @JoeyBob: it is correct to disable weak ciphers (which includes RC4) and SSLv3 protocol. It is wrong to disable all ciphers defined with SSLv3 because this leaves essentially only ciphers defined newly with TLS 1.2 - and thus only TLS 1.2 as protocol too.
    – Steffen Ullrich
    Sep 15, 2017 at 14:11
  • I think that's the exact issue which is why it's left us with no TLS 1.1 support for emails which in turn means some of our clients servers cannot open a secure connection to our server. The parm's I've been given are in OpenSSL format as follows "HIGH:!RC4:!SSLv2:!SSLv3"
    – Joey Bob
    Sep 15, 2017 at 14:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .