To maintain a wider range of compatibility with end-user browsers, Mail Express Server allows clients to connect initially using all supported SSL protocols. However, the list of allowed SSL algorithms is limited to a set of stronger SSL 3.0 and TLS 1.0 algorithms. As such, clients that attempt to connect using SSL 2.0 may do so, but then must negotiate that the remainder of the SSL session be handled under SSL 3.0 or TLS 1.0.
See also Enhanced Communication Security (FIPS).
The supported SSL protocols have been set using the following configuration item:
sslEnabledProtocols=”TLSv1, TLSv1.1, TLSv1.2”
The allowable values for this item include:
all
SSLv2
SSLv3
TLSv1, TLSv1.1, TLSv1.2
SSLv2+SSLv3
For more information on this setting refer to http://tomcat.apache.org/tomcat-7.0-doc/apr.html.
For information on higher security settings, refer to the “High Security Settings” section below.
The supported SSL algorithms have been limited to the following:
|
SSL Protocols |
OpenSSL Identifier |
Key Exchange |
Authentication |
Encryption |
MAC |
|
SSLv3, TLSv1 |
DHE-DSS-AES128-SHA |
Ephemeral |
DSA |
AES(128) |
SHA1 |
|
SSLv3, TLSv1 |
DHE-DSS-AES256-SHA |
Ephemeral |
DSA |
AES(256) |
SHA1 |
|
SSLv3, TLSv1 |
EDH-DSS-DES-CBC3-SHA |
Ephemeral |
DSA |
3DES(168) |
SHA1 |
|
SSLv3, TLSv1 |
IDEA-CBC-SHA |
RSA |
RSA |
IDEA(128) |
SHA1 |
|
SSLv3, TLSv1 |
AES128-SHA |
RSA |
RSA |
AES(128) |
SHA1 |
|
SSLv3, TLSv1 |
AES256-SHA |
RSA |
RSA |
AES(256) |
SHA1 |
|
SSLv3, TLSv1 |
DES-CBC3-SHA |
RSA |
RSA |
3DES(168) |
SHA1 |
|
SSLv3, TLSv1 |
DHE-RSA-AES128-SHA |
Ephemeral |
RSA |
AES (128) |
SHA1 |
|
SSLv3, TLSv1 |
DHE-RSA-AES256-SHA |
Ephemeral |
RSA |
AES(256) |
SHA1 |
|
SSLv3, TLSv1 |
EDH-RSA-DES-CBC3-SHA |
Ephemeral |
RSA |
3DES(168) |
SHA1 |
|
SSLv3, TLSv1 |
RC4-MD5 |
RSA |
RSA |
RC4(128) |
MD5 |
|
SSLv3, TLSv1 |
RC4-SHA |
RSA |
RSA |
RC4(128) |
SHA1 |
The SSL algorithm combinations using RSA for authentication will only be available when using an RSA key pair with the Server. Conversely, the SSL algorithm combinations using DSA for authentication will only be available when using a DSA key pair with the Server.
The SSL Algorithms have been constrained to strong types with the configuration item:
SSLCipherSuite="ALL:!ADH:!SSLv2:!SSLv3:! EXPORT40:!EXP:!LOW"
For more information on the format of this setting refer to https://www.openssl.org/docs/man1.0.2/apps/ciphers.html