Home / Blogs

Logjam, Openssl and Email Deliverability

BLACK FRIDAY DISCOUNT - CircleID x NordVPN
Get NordVPN  [74% +3 extra months, from $2.99/month]

RHEL6/Centos6 (and presumably RHEL7/Centos7) machines with the latest openssl packages now refuse SSL connections with DH keys shorter than 768 bits. Consider RHEL6 sendmail operating as a client, sending mail out to a target server. If the target server advertises STARTTLS, sendmail will try to negotiate a secure connection. This negotiation uses openssl, which will now refuse to connect to mail servers that have 512 bit DH keys. The maillog will contain entries with “reject=403 4.7.0 TLS handshake failed”.

If your mail server advertises STARTTLS, but only has a 512 bit DH key, you won’t receive any email from anyone running RHEL6 or other systems with that openssl logjam fix.

Read more details in the OpenSSL Blog on this issue.

Filed Under

Comments

RHEL5/Centos5 systems with all the current updates Carl Byington  –  Jun 22, 2015 6:07 PM

RHEL5/Centos5 systems with all the current updates have 512 bit DH keys. If a server key has been generated on such a system (to enable SMTP/STARTTLS), then the DH key needs to be manually updated.

openssl dhparam -out /etc/pki/tls/certs/dhparam.pem 2048

Then add

define(`confDH_PARAMETERS’,`/etc/pki/tls/certs/dhparam.pem’)

to /etc/mail/sendmail.mc, and

(cd /etc/mail; make; service sendmail restart)

Comment Title:

  Notify me of follow-up comments

We encourage you to post comments and engage in discussions that advance this post through relevant opinion, anecdotes, links and data. If you see a comment that you believe is irrelevant or inappropriate, you can report it using the link at the end of each comment. Views expressed in the comments do not represent those of CircleID. For more information on our comment policy, see Codes of Conduct.

CircleID Newsletter The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

Related

Topics

IPv4 Markets

Sponsored byIPv4.Global

Cybersecurity

Sponsored byVerisign

DNS

Sponsored byDNIB.com

Brand Protection

Sponsored byCSC

Domain Names

Sponsored byVerisign

Threat Intelligence

Sponsored byWhoisXML API

New TLDs

Sponsored byRadix