Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
I'm running an Exim MTA which only receives emails from a few other systems under my control. All these systems happily negotiate TLSv1.2/TLSv1.3 with my MTA. I would like to disable support for TLSv1.0 and TLSv1.1 but I can't find instructions on how to do so.
All software is installed from the official Debian 10 repository (Exim 4.92, GnuTLS 3.6.6).
Add the following line to this file /etc/exim4/exim4.conf.template somewhere like in the TLS section (or as described here):
tls_require_ciphers = SECURE192:!VERS-SSL3.0:!VERS-TLS1.0:!VERS-TLS1.1:!VERS-DTLS0.9:!VERS-DTLS1.0
Restart/reload exim with sudo systemctl restart exim4.
Verify the exim settings updated with sudo exim -bP | grep tls_require_ciphers.
For further reading on tls_require_ciphers see here.
See the bit about using tls_require_ciphers and the GnuTLS priority string definitions. The example which pertains to you is:
tls_require_ciphers = NORMAL:%LATEST_RECORD_VERSION:-VERS-SSL3.0
... which you could further tweak to suit your own requirements.
Add a line like this to the config file. Edit it for your required and unrequired ciphers.
# We need to disable SSL2 and key lengths < 128 bits for PCI compliance
tls_require_ciphers = ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+SHA:!MD5:!LOW:!SSLv2:!EXP:!DES
