Post #1902136
2026-04-23 15:34 UTC
anyone happen to know the magic setting to make #postfix not allow sha-1 for key exchange? #askfedi
Replies (4)
-
@ryanc@infosec.exchange 2026-04-23 16:30
@jelte It probably depends on whether you're using GnuTLS or OpenSSL?
-
@jpmens@mastodon.social 2026-04-23 19:06
@patrickbenkoetter can you help @jelte ?
-
@anton@social.dollmaier.name 2026-04-23 19:25
@jelte I suppose you're referring to TLS ciphers? Take a look here: https://ssl-config.mozilla.org/#server=postfix&version=3.9.0&config=modern&openssl=3.4.0&guideline=5.7 Cc @jpmens
-
@sash@hachyderm.io 2026-04-23 19:31
@jelte openssl calls this SignatureAlgorithms, and Postfix has no direct option for this, you need to do it through openssl.conf. Here's my latest config for this: https://github.com/internetstandards/Internet.nl/issues/1553#issuecomment-4306775294