Demo
Demo

Knowledge base

PMTA knowledge base›Block Global›Directive§ 3.3.1.58.10

http-tls-allow-tlsv1.1

Globaldeprecatedrestart required

Whether to accept TLS 1.1 on the web monitor — a deprecated switch
in the configuration this is a linehttp-tls-allow-tlsv1.1 falseinside the block Global
The old way to choose versions on the monitor

The line allows or forbids negotiating TLS 1.1 on web monitor connections. Deprecated since PowerMTA 5.5: instead of five switches the vendor offers two bounds — http-tls-min-version and http-tls-max-version.

The default is false. An intermediate version, off by default. The manual’s example shows true, but that is a sample of the syntax, not advice.

One of five such sets of five in the configuration. The same switches exist for sending to the receiver, for receiving mail by the node, for the listener, for the Transmissions API input and for the web monitor — twenty-five lines in five places. The migration rule is the same everywhere.

The main trap is mixing the two methods in one file. Switches and bounds describe the same thing, and the manual does not name the precedence between them. There will be no warning on apply.
What the Hub does. It does not write it: it uses the bounds, or rather their defaults. It is worth recognizing the line on sight when analyzing someone else’s configuration.
Recommended values

Do not translate the value — migrate it:

What it was What it became
tlsv1.2 and tlsv1.3 allowed nothing needs to be written, this is the default
all from tlsv1 allowed http-tls-min-version tlsv1
tlsv1.3 forbidden http-tls-max-version tlsv1.2
everything by default neither line is needed

The monitor’s default lower bound is tlsv1.2. After migration this is worth rechecking: the switches may have allowed more.

Deprecation as of version 5.5 and the defaults are from the manual (§ 3.3.1.58). The migration table is ours, common to all five such sets in the configuration.
Example configuration
# this is how it was before
http-mgmt-port 1000
http-tls-allow-tlsv1.1 true
# this is how it is written now
http-mgmt-port 1000
http-tls-min-version tlsv1.2
The lower set replaces the upper one. A pair of bounds describes the whole range at once and reads more easily than five switches.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
▲

Common mistakes and problems

what people get wrong and how it ends2 mistakes▶

Leaving switches next to bounds

§ 3.3.1.58

What it costsThe two methods describe the same thing, and the manual does not name the precedence between them. The configuration reads ambiguously.
How to spot itThe negotiated version matches neither what the switches allow nor what the bounds set.
How to do it rightRemove the switches and keep only the bounds.

Migrating the monitor lines together with the mail lines

our experience

What it costsThe sets have similar names and sit side by side, but they configure different interfaces. Migrating them “in a batch” changes mail behavior along with the monitor.
How to spot itAfter the edit, negotiation changed where it was not touched.
How to do it rightMigrate each set separately: the http- prefix is about the monitor, smtp-server- about receiving mail, smtp- about sending.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
Reference data
Syntax
http-tls-allow-tlsv1.1 <boolean>
Values
yes | no | true | false
Default
false § 3.3.1.58.10
Applying
a service restart is required
Queue
will not touch what is already queued
Where to write it
Global
How many times
once in the block
Everything here comes from the manual, with the section.
Inheritance
The directive has no inheritance: it is written at the root of the file, the Global section, and applies to the node’s whole management interface. The bounds that replace it are in the same place and with the same scope.
⇄

Related directives

2 relations

Replaced by

http-tls-min-versionGlobalReplaced the whole set of five switches: the monitor’s version range is set by a pair of bounds. § 3.3.1.58.10

Applies to

http-mgmt-portGlobalOne of the settings of the very interface that listens on this port. § 3.3.1.58.10

How to check on the node
Finding such lines is the first step of migration; the configuration has five sets of them, in different places:
grep -rn "tls-allow-" /etc/pmta/
Switches for sending, receiving by the node, the listener, the Transmissions API input and the web monitor will be found. They should be replaced with pairs of bounds, and the result checked by negotiation.
◇

What else to read

3 articles

◇Who is allowed to submit mail and for whom to accept itOut of the box, the node accepts submission only from the machine itself; two different questions — “who can send through us” and “for whose addresses we accept mail” — are answered by different directives.◇The group that grants management rightsMembership in the pmta group gives an unprivileged user the right to call the node’s commands and use submission.◇How the node selects a source and combines its settingsA connection falls under all source blocks whose addresses cover it, and they act merged — the narrow one overrides the wide one; named blocks are attached only by direct reference.

In the Hub
Cost of a mistake
safe: a wrong value breaks nothing
Scenarios
Node security
Neighboring settings of the block Global:smtp-server-tls-certificateopenssl-security-levelsmtp-server-tls-min-versionhttp-tls-min-versionsmtp-server-tls-cipher-server-preferenceAll 108 directives of the block →