Re: Problems connecting to imap after upgrade of openssl to v3

On Thu, Oct 26, 2023 at 8:28 AM Kristian Duus Østergaard <
[email protected]> wrote:

>
> The problem was that my combined certificates did not have the
> DH-parameters as part of the PEM file. After adding the DH as per :
>
> https://github.com/svarshavchik/courier/issues/48
>
> The server now works normally again.
>
>
> But according to the bug report this should not be necessary and was not
> necessary with openssl-1.1.1u, so how can I help you triage this problem
> Sam ?
>

DH parameters are only required for specific cipher suites. To make things
complicated, server certificates may also impose restrictions on which
cipher suites can be used with the TLS connection. Adding to the confusion
is the deprecation of older TLS versions that are no longer considered
secure.

So, the approach in Courier was to allow, but not require, DH parameters as
part of the SSL configuration. Courier's default packaging creates DH
parameters automatically, and regenerates them every month.

If the TLS connection ends up requiring DH parameters, great. If not, they
do nothing. However, their presence or absence could result in (older)
OpenSSL limited to what's now considered to be less secure cipher-suites by
default. OpenSSL 1 continued to accept and manage SSL connections, but
using what's now considered to be less secure ciphersuites.

And with OpenSSL 3 that was no longer an option. I have a dim recollection
of reading something about OpenSSL going to automatically generate DH
parameters in the event the application did not set them up itself, so it
might just be a temporary pain (although pregenerated DH parameters would
always be preferred, generating them on the fly isn't very time consuming,
but it's still noticeable).




> --
>
> Mvh./Regards
>
>  Kristian Duus Østergaard
>
> Kristian Duus Consult
>
> email: [email protected]
>
> mobil: +45 22114772
> _______________________________________________
> courier-users mailing list
> [email protected]
> Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users
>

_______________________________________________
courier-users mailing list
[email protected]
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users