Stack Exchange Network
Stack Exchange network consists of 181 Q&A communities including
Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.
Visit Stack Exchange
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
Anybody can ask a question
The best answers are voted up and rise to the top
3 years ago
I'm running an
Exim MTA which only receives emails from a few other systems under my control. All these systems happily negotiate TLSv1.2/TLSv1.3 with my MTA. I would like to disable support for TLSv1.0 and TLSv1.1 but I can't find instructions on how to do so.
All software is installed from the official Debian 10 repository (Exim 4.92, GnuTLS 3.6.6).
May 18, 2020 at 1:58
Martin Konrad Martin Konrad
2,060 2 2 gold badges 15 15 silver badges 30 30 bronze badges
Add the following line to this file
/etc/exim4/exim4.conf.template somewhere like in the TLS section (or as described
tls_require_ciphers = SECURE192:!VERS-SSL3.0:!VERS-TLS1.0:!VERS-TLS1.1:!VERS-DTLS0.9:!VERS-DTLS1.0
For further reading on tls_require_ciphers see
Aug 28, 2022 at 2:35
121 3 3 bronze badges
GnuTLS options in Exim
See the bit about using
tls_require_ciphers and the GnuTLS priority string definitions. The example which pertains to you is:
tls_require_ciphers = NORMAL:%LATEST_RECORD_VERSION:-VERS-SSL3.0
... which you could further tweak to suit your own requirements.
21.3k 20 20 gold badges 47 47 silver badges 71 71 bronze badges
Aug 4, 2020 at 12:21
31 3 3 bronze badges
Add a line like this to the config file. Edit it for your required and unrequired ciphers.
# We need to disable SSL2 and key lengths < 128 bits for PCI compliance
tls_require_ciphers = ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+SHA:!MD5:!LOW:!SSLv2:!EXP:!DES
Jun 17, 2020 at 20:10
log in to answer this question.
Not the answer you're looking for? Browse other questions tagged
By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our
Accept all cookies
Necessary cookies only