Re: disable tls1.3 for a specific destination domain

On 2026/06/25 2:58 PM, Cyborg via Exim-users wrote:
> Any Ideas how to tell exim to not use tls 1.3 on that connection?

There's a relevant config in the testsuite which has

.ifdef _HAVE_GNUTLS
tls_require_ciphers = ${if eq {TRUSTED}{TLS1.2} {NORMAL:!VERS-ALL:+VERS-TLS1.2} {}}
.endif
.ifdef _HAVE_OPENSSL
openssl_options = ${if eq {TRUSTED}{TLS1.2} {+no_tlsv1_3} {}}
.endif

You didn't say which TLS library you use.

Ignore the "eq" test - I left that in just to prove that the options
are expanded.  You might not need an expansion.

Now, these are main-section options so the gnutls one will be affecting
receiving not sending.  However, the smtp transport also takes on option
by that name; worth trying.

For openssl, you're stuck with affecting the entire system.  I suppose you
could stand up a proxy exim just for this flow - but that's a lot of effort.
Although the option is expended, I don't know if you could work out a test
that did not affect the receive process but did affect the delivery.

-- 
Cheers,
   Jeremy

-- 
## subscription configuration (requires account):
##   https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
##   [email protected]
## Exim details at https://www.exim.org/
## Please use the Wiki with this list - https://code.exim.org/exim/wiki/wiki