Re: Troubles with SSL ciphers

On 2026/07/05 12:02 PM, Klaus Ethgen via Exim-users wrote:
>  From https://configurator.tlsref.org/ I get the following[0]:
> openssl_options = +no_sslv2 +no_sslv3 +no_tlsv1 +no_tlsv1_1
> tls_eccurve = X25519MLKEM768:X25519:prime256v1:secp384r1
> tls_require_ciphers = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305
> 
> unfortunately, the tls_eccurve option is not working and produces errors
> due to X25519MLKEM768.
> 
> On much lower version on devuan os that settings was working. But I
> think, devuan uses gnutls instead of openssl. On gentoo, gnutls is
> incompatible with dane so that is not an option.
> 
> Any idea what happened to that option?

Assuming you mean the Exim tls_eccurve option:
you didn't say what OpenSSL version, nor exactly what investigation
you have done.  According to
https://docs.openssl.org/master/man3/SSL_CTX_set1_curves/#history
support for X25519MLKEM768 arrived in 3.5.

(If you meant the option of using gentoo, I have to wonder what they broke.
Exim with GnuTLS DANE testing works just fine, in the regression testsuite).

-- 
Cheers,
   Jeremy

-- 
## subscription configuration (requires account):
##   https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
##   [email protected]
## Exim details at https://www.exim.org/
## Please use the Wiki with this list - https://code.exim.org/exim/wiki/wiki