Re: Troubles with SSL ciphers

--===============8485136788452928071==
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="ierPGj8LQz6Av3aA"
Content-Disposition: inline


--ierPGj8LQz6Av3aA
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline

Am So den  5. Jul 2026 um 13:24 schrieb Jeremy Harris via Exim-users:
> On 2026/07/05 12:02 PM, Klaus Ethgen via Exim-users wrote:
> >  From https://configurator.tlsref.org/ I get the following[0]:
> > openssl_options = +no_sslv2 +no_sslv3 +no_tlsv1 +no_tlsv1_1
> > tls_eccurve = X25519MLKEM768:X25519:prime256v1:secp384r1
> > tls_require_ciphers = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305
> > 
> > unfortunately, the tls_eccurve option is not working and produces errors
> > due to X25519MLKEM768.
[...]
> Assuming you mean the Exim tls_eccurve option:

Yes, that's what I'm asking about.

> you didn't say what OpenSSL version, nor exactly what investigation
> you have done.  According to
> https://docs.openssl.org/master/man3/SSL_CTX_set1_curves/#history
> support for X25519MLKEM768 arrived in 3.5.

I added the link in my previous mail which has the versions in it. I use
openssl 3.5.7.

So according your Information, that should be in openssl.

> (If you meant the option of using gentoo, I have to wonder what they broke.
> Exim with GnuTLS DANE testing works just fine, in the regression testsuite).

I have no idea. I tried but the use options disallow gnutls with DANE.
Maybe it is just artificial.

Regards
   Klaus
-- 
Klaus Ethgen                                       http://www.ethgen.ch/
pub  4096R/4E20AF1C 2011-05-16            Klaus Ethgen <[email protected]>
Fingerprint: 85D4 CA42 952C 949B 1753  62B3 79D0 B06F 4E20 AF1C

--ierPGj8LQz6Av3aA
Content-Type: application/pgp-signature; name=signature.asc

-----BEGIN PGP SIGNATURE-----
Comment: Charset: ISO-8859-1

iQHPBAABCgA5FiEE2oNkebTd5YKFiBG5fue2cNoeGfgFAmpKZLsbFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMiwyAAoJEH7ntnDaHhn460AMAJTth4xYIGYYOGRk3o1q
viTpvFzSYRhPKiF6XZWuEsPdSXHMn2tQyX1Bl0AGeV5tDnyu+gxKgzHHGCVNuiKd
yJzvOkdcKH3D23JBXp3Eecq9TLViW6vUgveKe1rAbDplFEHV5YDuC4svnuZhodxk
SlJml/tMeztQSw3NZ87u0psxFFsiwNx3RtV48lm8XTK1hVcci3eiftjcvzsRnlFY
EVFq4sW+bnq2heM2wWRrbd3OTPDX46hnzKr0tlcV+V9f38d9xcZxRP/5s1w5sJD2
3hi2WaRiARa49rWJ/pPkX0Evw2NpmxcO9g5Nqny9Esb+wxIAja6mWR28nVmnNXhB
kJDzrj5pkHTAp/tXjqtfaGGol+sJklNAeqeafSkHQJ22dM46ICohMeQKibLZTQYZ
g1Xa5OGq+E9Odn32CcZeWhe7UVmn71eP+qjiXUyIyPGIApvb9uffvEBtpTnNs0TG
+2VcTGLtNzP3k1DIh+WAi8mcxbyM2JQw9fe473vYQrBwFw==
=fuZu
-----END PGP SIGNATURE-----

--ierPGj8LQz6Av3aA--

--===============8485136788452928071==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


-- 
## subscription configuration (requires account):
##   https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
##   [email protected]
## Exim details at https://www.exim.org/
## Please use the Wiki with this list - https://code.exim.org/exim/wiki/wiki

--===============8485136788452928071==--