Re: No supported cipher suites have been found.

Sam Varshavchik <[email protected]> Sun, 01 Dec 2024 01:37:21 -0500

Newsgroups	gmane.mail.imap.courier.general
Message-ID	<[email protected]>

Mike Wright writes:

> I have no other reports of bounced mail.
>
> Journalctl reports this message (their IP is obfuscated)
>
> courieresmtpd: STARTTLS failed: ip=[::ffff:a.b.c.d], No supported cipher  
> suites have been found.
>
> The esmptd-ssl file is unmodified except for the TLS_* certificate  
> locations, SSLADDRESS=serverIP, and ESMTPDSSLSTART=YES.
>
> The most recent letsencrypt certificates are dated Oct 26.

The two most common reasons for this are:

- the peer does not like the certificate's hash functions. Some hash  
functions, like MD5, are considered deprecated, and some TLS peers will  
reject certificates that use deprecated hash functions.

I would expect, though, for letsencrypt to be up to speed, in this regard.

- the most literal meaning: the peer does not like the server's list of  
supported ciphers, some TLS peers will only find DHE ciphers acceptable, for  
reasons that are unimportant. Check what TLS_DHPARAMS in the esmtpd-ssl  
configuration file is set to, and make sure that it actually exists, and  
contains DH parameters. There should be a script that periodically generates  
the dh parameters file (at least the default Courier scripts do).

_______________________________________________
courier-users mailing list
[email protected]
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users

signature.asc (application/pgp-signature, 228 B)