ianqert.blogg.se

To use a custom set of protocols, list the protocol names, separated by commas, in the variable.įor example: SSLv3,TLSv1,TLSv1.1,TLSv1.2 ServerTlsCiphers Leave the variable empty to use a default set of SSL/TLS protocols: TLSv1,TLSv1.1,TLSv1.2 In this variable, you can change the SSL/TLS protocols used by Kerio Connect. If you set the variable to 0, some older implementations of SSL may not connect to Kerio Connect servers.

The default value, 1, disables the OpenSSL workaround for the CVE-2011-3389 vulnerability. ECDHE is more efficient than DHE and uses shorter keys. The server generates a random ephemeral public key for each session so that attackers cannot decipher past sessions. The default value, 1, enables ECDHE for key exchange. You can change the default value to 1024, 2048, or 4096 AllowEphemeralECDH Make sure the DisableEphemeralDH is enabled. The default value, 0, sets the size of DHE to 2048 (1024 for SMTP services). These ciphers are not recommended for compliance: Weak Ciphers

Here is a list of strong ciphers available: Strong ciphers (Recommended) It is recommended to use only strong ciphers suites to ensure compliance with various compliance standards. Kerio Connect sets the default values of all the SSL/TLS variables. Delete any variable in the Security or SmtpSecurity sections.To reset the SSL/TLS configuration in the configuration file: Change the settings in the Security or SmtpSecurity sections.For more information refer to Configuration files. Open the configuration file mailserver.cfg for editing.

Kerio Connect uses different variables for the SSL Secure Sockets Layer - A protocol that ensures integral and secure communication between networks./ TLS Transport Layer Security - A follower of the SSL protocol and ensures secure communication between networks. (You can test your server, for example, at Qualys SSLlabs test site). You might need to adjust the security settings when a flaw in a security protocol is found or to get a good security rating for your server. services separately (for SMTP on port 25 and SMTPS on port 465)