Maxfield Luke
67c1d41a0c
Fresh repository history for elektrine/elektrine-haraka hosted at https://git.elektrine.com/elektrine/elektrine-haraka.
30 lines
905 B
INI
30 lines
905 B
INI
[main]
|
|
key=/app/ssl/cert.key
|
|
cert=/app/ssl/cert.crt
|
|
|
|
# Strong ciphers only - ECDHE preferred, AES-GCM and ChaCha20
|
|
ciphers=ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!SRP
|
|
|
|
# TLS 1.2 minimum - TLS 1.0 and 1.1 are deprecated (RFC 8996)
|
|
minVersion=TLSv1.2
|
|
maxVersion=TLSv1.3
|
|
|
|
# No client certificate requirements
|
|
requestCert=false
|
|
rejectUnauthorized=false
|
|
|
|
# Enable renegotiation protection (CVE-2009-3555)
|
|
secureRenegotiation=true
|
|
|
|
# Server chooses cipher order (prefer strongest available)
|
|
honorCipherOrder=true
|
|
no_starttls_ports[]=465
|
|
dhparam=/app/ssl/dhparam.pem
|
|
|
|
[outbound]
|
|
rejectUnauthorized=false
|
|
|
|
; Local-domain mail is routed to the internal inbound container. That hop does
|
|
; not need STARTTLS, and the container hostname does not match the public
|
|
; *.elektrine.com certificate, which otherwise logs ERR_TLS_CERT_ALTNAME_INVALID.
|
|
no_tls_hosts[]=haraka-inbound
|