Задать вопрос

I_am_PiT

Комментарии

  • Почему почтовые клиенты не могут создать защищенное соединение с почтовым сервером на mailcow?

    @I_am_PiT Автор вопроса
    Да. это все есть
    Certificate chain
    spoiler
    0 s:CN = mail.x.ru
    i:C = US, O = Let's Encrypt, CN = R13
    a:PKEY: rsaEncryption, 4096 (bit); sigalg: RSA-SHA256
    v:NotBefore: Jan 22 10:48:28 2026 GMT; NotAfter: Apr 22 10:48:27 2026 GMT
    1 s:C = US, O = Let's Encrypt, CN = R13
    i:C = US, O = Internet Security Research Group, CN = ISRG Root X1
    a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
    v:NotBefore: Mar 13 00:00:00 2024 GMT; NotAfter: Mar 12 23:59:59 2027 GMT

    Чувство, что надо версию TLS ковырять. У меня в том же выводе:
    Post-Handshake New Session Ticket arrived:
    SSL-Session:
    Protocol : TLSv1.3
    Cipher : TLS_AES_256_GCM_SHA384
    В сертификате mail.ru
    SSL-Session:
    Protocol : TLSv1.2
    Cipher : ECDHE-RSA-AES128-GCM-SHA256
    L`E вроде должен генерировать совместимый 1.2-1.3 сертификат. Или все же, если клиент TLS 1.3 не понимает, то сертификат не расшифрует соединения не случится...

    Майл.ру поддерживает старые протоколы вплоть до 1.0
    nmap --script ssl-enum-ciphers -p 993,465 imap.mail.ru
    spoiler
    PORT STATE SERVICE
    465/tcp filtered smtps
    993/tcp open imaps
    | ssl-enum-ciphers:
    | TLSv1.0:
    | ciphers:
    | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A
    | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (ecdh_x25519) - A
    | TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
    | TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
    | TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
    | compressors:
    | NULL
    | cipher preference: server
    | warnings:
    | 64-bit block cipher 3DES vulnerable to SWEET32 attack
    | TLSv1.1:
    | ciphers:
    | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A
    | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (ecdh_x25519) - A
    | TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
    | TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
    | TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
    | compressors:
    | NULL
    | cipher preference: server
    | warnings:
    | 64-bit block cipher 3DES vulnerable to SWEET32 attack
    | TLSv1.2:
    | ciphers:
    | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A
    | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A
    | TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A
    | TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh 1024) - A
    | TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 1024) - A
    | TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (dh 1024) - A
    | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (ecdh_x25519) - A
    | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A
    | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ecdh_x25519) - A
    | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (ecdh_x25519) - A
    | TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (dh 1024) - A
    | TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 1024) - A
    | TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A
    | TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A
    | TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A
    | TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A
    | TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
    | TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
    | TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
    | compressors:
    | NULL
    | cipher preference: server
    | warnings:
    | 64-bit block cipher 3DES vulnerable to SWEET32 attack
    | Key exchange (dh 1024) of lower strength than certificate key
    |_ least strength: C

    При этом секции 1.3 совсем нет

    У меня только 1.2
    spoiler
    PORT STATE SERVICE
    465/tcp open smtps
    | ssl-enum-ciphers:
    | TLSv1.2:
    | ciphers:
    | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A
    | TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 2048) - A
    | TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A
    | TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (dh 2048) - A
    | TLS_DHE_RSA_WITH_AES_256_CCM_8 (dh 2048) - A
    | TLS_DHE_RSA_WITH_AES_256_CCM (dh 2048) - A
    | TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 (ecdh_x25519) - A
    | TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384 (dh 2048) - A
    | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ecdh_x25519) - A
    | TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 2048) - A
    | TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 (ecdh_x25519) - A
    | TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 (dh 2048) - A
    | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (ecdh_x25519) - A
    | TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 2048) - A
    | TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA (dh 2048) - A
    | TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 4096) - A
    | TLS_RSA_WITH_AES_256_CCM_8 (rsa 4096) - A
    | TLS_RSA_WITH_AES_256_CCM (rsa 4096) - A
    | TLS_RSA_WITH_ARIA_256_GCM_SHA384 (rsa 4096) - A
    | TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 4096) - A
    | TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 (rsa 4096) - A
    | TLS_RSA_WITH_AES_256_CBC_SHA (rsa 4096) - A
    | TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (rsa 4096) - A
    | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A
    | TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh 2048) - A
    | TLS_DHE_RSA_WITH_AES_128_CCM_8 (dh 2048) - A
    | TLS_DHE_RSA_WITH_AES_128_CCM (dh 2048) - A
    | TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 (ecdh_x25519) - A
    | TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256 (dh 2048) - A
    | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (ecdh_x25519) - A
    | TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (dh 2048) - A
    | TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 (ecdh_x25519) - A
    | TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 (dh 2048) - A
    | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A
    | TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048) - A
    | TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA (dh 2048) - A
    | TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 4096) - A
    | TLS_RSA_WITH_AES_128_CCM_8 (rsa 4096) - A
    | TLS_RSA_WITH_AES_128_CCM (rsa 4096) - A
    | TLS_RSA_WITH_ARIA_128_GCM_SHA256 (rsa 4096) - A
    | TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 4096) - A
    | TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 (rsa 4096) - A
    | TLS_RSA_WITH_AES_128_CBC_SHA (rsa 4096) - A
    | TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (rsa 4096) - A
    | compressors:
    | NULL
    | cipher preference: server
    | warnings:
    | Key exchange (dh 2048) of lower strength than certificate key
    | Key exchange (ecdh_x25519) of lower strength than certificate key
    |_ least strength: A
    993/tcp open imaps
    | ssl-enum-ciphers:
    | TLSv1.2:
    | ciphers:
    | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A
    | TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 2048) - A
    | TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A
    | TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (dh 2048) - A
    | TLS_DHE_RSA_WITH_AES_256_CCM (dh 2048) - A
    | TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 (ecdh_x25519) - A
    | TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384 (dh 2048) - A
    | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A
    | TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh 2048) - A
    | TLS_DHE_RSA_WITH_AES_128_CCM (dh 2048) - A
    | TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 (ecdh_x25519) - A
    | TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256 (dh 2048) - A
    | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ecdh_x25519) - A
    | TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 2048) - A
    | TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 (ecdh_x25519) - A
    | TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 (dh 2048) - A
    | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (ecdh_x25519) - A
    | TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (dh 2048) - A
    | TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 (ecdh_x25519) - A
    | TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 (dh 2048) - A
    | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (ecdh_x25519) - A
    | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A
    | TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 4096) - A
    | TLS_RSA_WITH_AES_256_CCM (rsa 4096) - A
    | TLS_RSA_WITH_ARIA_256_GCM_SHA384 (rsa 4096) - A
    | TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 4096) - A
    | TLS_RSA_WITH_AES_128_CCM (rsa 4096) - A
    | TLS_RSA_WITH_ARIA_128_GCM_SHA256 (rsa 4096) - A
    | TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 4096) - A
    | TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 (rsa 4096) - A
    | TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 4096) - A
    | TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 (rsa 4096) - A
    | compressors:
    | NULL
    | cipher preference: server
    | warnings:
    | Key exchange (dh 2048) of lower strength than certificate key
    | Key exchange (ecdh_x25519) of lower strength than certificate key
    |_ least strength: A


    Попробую для начала в postfix и dovecot старые TLS дабавить
    Написано