[main]
key=/app/ssl/cert.key
cert=/app/ssl/cert.crt

# Strong ciphers only - ECDHE preferred, AES-GCM and ChaCha20
ciphers=ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!SRP

# TLS 1.2 minimum - TLS 1.0 and 1.1 are deprecated (RFC 8996)
minVersion=TLSv1.2
maxVersion=TLSv1.3

# No client certificate requirements
requestCert=false
rejectUnauthorized=false

# Enable renegotiation protection (CVE-2009-3555)
secureRenegotiation=true

# Server chooses cipher order (prefer strongest available)
honorCipherOrder=true
no_starttls_ports[]=465
dhparam=/app/ssl/dhparam.pem

[outbound]
rejectUnauthorized=false

; Local-domain mail is routed to the internal inbound container. That hop does
; not need STARTTLS, and the container hostname does not match the public
; *.elektrine.com certificate, which otherwise logs ERR_TLS_CERT_ALTNAME_INVALID.
no_tls_hosts[]=haraka-inbound