Re: [exim] OpenSSL IOT woes

2022-10-03 Thread Viktor Dukhovni via Exim-users
On Mon, Oct 03, 2022 at 07:22:29PM +0100, Jeremy Harris via Exim-users wrote: > On 03/10/2022 18:08, Jeremy Harris via Exim-users wrote: > > Could the min/max protocol stuff mentioned in > > https://www.openssl.org/docs/man1.1.1/man3/SSL_CONF_cmd.html > > be affecting it? > > Exim has no

Re: [exim] OpenSSL IOT woes

2022-10-03 Thread Jeremy Harris via Exim-users
On 03/10/2022 18:08, Jeremy Harris via Exim-users wrote: Could the min/max protocol stuff mentioned in https://www.openssl.org/docs/man1.1.1/man3/SSL_CONF_cmd.html be affecting it? Exim has no SSL_CONF_* calls currently; probably never has in it's history. Bingo. The value given by

Re: [exim] OpenSSL IOT woes

2022-10-03 Thread Viktor Dukhovni via Exim-users
On Mon, Oct 03, 2022 at 06:08:58PM +0100, Jeremy Harris via Exim-users wrote: > > Presumably it'll work for you if you connect to: > > > > [dnssec-stats.ant.isi.edu]:25 > > It does. Ok, so the client side is not the problem... > > So the barrier is some interaction between Exim and

Re: [exim] OpenSSL IOT woes

2022-10-03 Thread Jeremy Harris via Exim-users
On 30/09/2022 21:33, Viktor Dukhovni via Exim-users wrote: On Fri, Sep 30, 2022 at 09:18:08PM +0100, Jeremy Harris via Exim-users wrote: On 30/09/2022 20:28, Viktor Dukhovni via Exim-users wrote: Does "s_client -tls1_1 -cipher ALL:@SECLEVEL=0" work? Let's first sort that out. It does not.

Re: [exim] OpenSSL IOT woes

2022-09-30 Thread Viktor Dukhovni via Exim-users
On Fri, Sep 30, 2022 at 09:18:08PM +0100, Jeremy Harris via Exim-users wrote: > On 30/09/2022 20:28, Viktor Dukhovni via Exim-users wrote: > > Does "s_client -tls1_1 -cipher ALL:@SECLEVEL=0" work? Let's first > > sort that out. > > It does not. The same Fatal Alert. Presumably it'll work for

Re: [exim] OpenSSL IOT woes

2022-09-30 Thread Jeremy Harris via Exim-users
On 30/09/2022 20:28, Viktor Dukhovni via Exim-users wrote: Does "s_client -tls1_1 -cipher ALL:@SECLEVEL=0" work? Let's first sort that out. It does not. The same Fatal Alert. -- Cheers, Jeremy -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim details at

Re: [exim] OpenSSL IOT woes

2022-09-30 Thread Viktor Dukhovni via Exim-users
On Fri, Sep 30, 2022 at 08:14:20PM +0100, Jeremy Harris via Exim-users wrote: > > Does its cipherlist end with ":@SECLEVEL=0" (or does it explicitly > > set the security level via the OpenSSL API). > > The latter. > > I can add calls to read out bit of setup just before SSL_accept, if you >

Re: [exim] OpenSSL IOT woes

2022-09-30 Thread Jeremy Harris via Exim-users
On 30/09/2022 19:17, Viktor Dukhovni via Exim-users wrote: openssl_options = -no_sslv3 -no_tlsv1_1 -no_tlsv1 doesn't change the result. That sets a floor, rather than clearing it. You're explicitly turning off SSL 3.0, TLS 1.0 and TLS 1.1. No. This is the exim option not an s_client

Re: [exim] OpenSSL IOT woes

2022-09-30 Thread Viktor Dukhovni via Exim-users
On Fri, Sep 30, 2022 at 07:05:52PM +0100, Jeremy Harris via Exim-users wrote: > On 30/09/2022 18:34, Viktor Dukhovni via Exim-users wrote: > > Do you also have a TLS version floor? "protocol version" sure sounds > > like it. > > Not as far as I know, and >openssl_options = -no_sslv3

[exim] OpenSSL IOT woes

2022-09-30 Thread Jeremy Harris via Exim-users
On 30/09/2022 18:34, Viktor Dukhovni via Exim-users wrote: Do you also have a TLS version floor? "protocol version" sure sounds like it. Not as far as I know, and openssl_options = -no_sslv3 -no_tlsv1_1 -no_tlsv1 doesn't change the result. There is indeed a "protocol version" fatal alert