exim - tls_certificate / ciphers settings

[cristian]

Hello

I have a problem with my server i cannot receive emails from one domain.
Is very important since a lot of people use there site and they need confirmation code.


The admin of the domain said that my server do not accept emails from his server because is old server and i have "bad" ciphers settings.

The server is new just installed i switched from centos to debian / last version for directadmin & exim.

i made some test and i can receive email from that host only if i disable tls_certificate from exim.variables.conf

But then i cannot send emails.


unfortunately I don't know very well how this part works and I have never had such problems. (first time i heard about ciphers ...)


I don't know exactly what to do if i leave tls_certificate option disabled, the send server does not work properly
If i disable tls_require_ciphers is not working to receive emails from that host only if i disable tls_certificate

Maybe i can whitelist that domain so i can receive emails


I appreciate any help. Thank you!

 

[cristian]

I found the solution.

1) I updated openssl.
2) Updated letsencrypt
cd /usr/local/directadmin/custombuild
./build update
./build letsencrypt

3) new ssl for hostname

https://help.directadmin.com/item.php?id=629

nmap --script ssl-enum-ciphers -p 465 127.0.0.1

Before
Starting Nmap 6.40 ( http://nmap.org ) at 2021-10-27 17:53 EEST
Nmap scan report for localhost.localdomain (127.0.0.1)
Host is up (0.00013s latency).
PORT STATE SERVICE
465/tcp open smtps
| ssl-enum-ciphers:
| TLSv1.2:
| ciphers:
| TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 - strong
| TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 - strong
| compressors:
| NULL
|_ least strength: strong


After
Starting Nmap 6.40 ( http://nmap.org ) at 2021-10-27 17:56 EEST
Nmap scan report for localhost.localdomain (127.0.0.1)
Host is up (0.00014s latency).
PORT STATE SERVICE
465/tcp open smtps
| ssl-enum-ciphers:
| TLSv1.2:
| ciphers:
| TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 - strong
| TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 - strong
| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - strong
| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 - strong
| compressors:
| NULL
|_ least strength: strong