On Fri, Oct 31, 2025 at 12:33:43PM +0100, Wolfgang Breyha via Exim-users wrote:
> On 26/10/2025 04:37, Viktor Dukhovni via Exim-users wrote:
> > If this hangs after printing "SSL_connect:SSLv3/TLS write client hello",
> > you likely have a problem, to confirm, you can try again with:
> >
> > $ host=your.server-fqdn.example
> > $ (sleep 2; printf 'QUIT\r\n') |
> > openssl s_client -starttls smtp -connect $host:25 \
> > -groups "X25519MLKEM768:*X25519:P-256:ffdhe3072" -state -brief
> >
> > and if that succeeds promptly, it is appropriate to take action to find
> > out what's causing the problem, and take steps to remediate it.
>
> Well, that's ugly in combination with DANE... eg. mail[12].polisen.se needs it
> # openssl s_client -starttls smtp -connect mail1.polisen.se:25 -groups
> "X25519MLKEM768:*X25519:P-256:ffdhe3072"
> works, but with MLKEM [as an unsolicited initial keyshare] it doesn't.
Thanks, that's now three not particularly obscure domains I'm aware of
with MX hosts that exhibit symptoms of aversion to larger TLS Client
Hellos. The other two being "minaz.nl" and "handelshanken.se". I've
sent notices to contact email addresses of the latter two, I hope
they'll take prompt action. Have you by any chance made contact with
polisen.se?
> I get the feeling that it is not safe to generally use it on an outgoing
> relay yet.
If by "it" you mean sending of unsolicited initial X25519MLKEM768
keyshares by clients, then yes, sadly at the present moment this
requires some willingness to make exceptions for problem destinations,
or else configurations that defer these keyshares until the server
solicits them by sending an HRR.
Of course there might still be a much smaller set of servers that are
desperate to shoot themselves in the foot, and solicit keyshares that
they, or, more likely, some middlebox in front of them can't handle, but
those I'd expect to be considerably more rare.
Nevertheless, I hope operators who somehow hear about this issue will
make some effort to fix any related obstacles in their infrastructure.
The issue will otherwise over time hamper communication with a growing
set of clients.
--
Viktor. 🇺🇦 Слава Україні!
--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## [email protected]
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/
