Hey everybody,
I started a small discussion in this PR
(https://github.com/apache/james-project/pull/3224) on the extent TLS
connection handling should be part of James.
Benoit summarized the current state:
- For "older" email protocols (IMAP, SMTP, ...): James supports PEM-encoded
X.509 certificates or Java keystores for implicit TLS or STARTTLS
- JMAP: James relies on a reverse proxy to handle TLS
- Webadmin: James supports Java keystores and
https://github.com/apache/james-project/pull/3224 wants to add support for
PEM-encoded X.509 certificates
Now my personal opinion:
Java keystores are a thing of the past. I think it could make the James code
less complex and reduce the number of configuration options if support for Java
keystores was removed for all protocols.
Additionally, I do not think that webadmin needs any kind of TLS support on the
James side.
The reason is that there are enough HTTP reverse proxies available that can
handle TLS much better than James. They have for example support for ACME to
directly retrieve valid certificates, HTTP/3 for reduced latency, HTTP to HTTPS
redirects, basic auth, HTTP security headers like HSTS, and much more.
Implementing all those features does not make sense because the result will
probably never be as good as other projects that focus only on that part. It
would also greatly increase the complexity of the James codebase. Without
support for automatic certificate rotation, additional software is always
needed, so I also do not really see a need for the basic TLS functionality
currently implemented in webadmin.
For the non-web-based email protocols, I'm totally fine with the current state.
There are less reverse proxies for layer 4 and because of STARTTLS, some TLS
support is required anyway.
I still think that also the configuration does not need to support Java
keystores anymore.
Have a nice weekend,
Felix
---
Gesellschaft für interkulturelles
Zusammenleben gGmbH (GIZ)
Felix Auringer
IT
Reformationsplatz 2
13597 Berlin
Tel: 030/513 0100 00; Fax: 030/513 0100 09
www.giz.berlin; [email protected]
Amtsgericht Charlottenburg HRB 200872 B
Geschäftsführerin: Dr. Britta Marschke
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
