Demo
Demo

Knowledge base

PMTA knowledge base›Block Global›Directive§ 3.3.1.58.15

http-tls-ciphers

Globalrestart required

The web monitor's cipher set for versions up to TLS 1.2
in the configuration this is a linehttp-tls-ciphers HIGH:!ADH:@STRENGTHinside the block Global
Ciphers of the management interface

The same kind of list as for mail, but for web monitor connections. The notation is that of the OpenSSL ciphers command, the default is HIGH:!ADH:@STRENGTH: only strong suites, without anonymous key exchange, sorted by strength.

It applies up to and including TLS 1.2. Version 1.3 has its own list — http-tls-v1.3-ciphersuites, and it is not set by this line.

The order matters only together with http-tls-cipher-server-preference: by default the client chooses the cipher, and the @STRENGTH sorting in the list has no effect.

The default here almost never needs touching. The monitor’s clients are your own, and there is nothing to narrow the list for in the name of “hardening”: HIGH already excludes the weak ones.

The main trap is narrowing the list and locking yourself out. A client that finds no common cipher will not connect at all. On the management interface this means losing access to the node — and restoring it will have to be done from the console, because the monitor is the way to reach it.
What the Hub does. It does not write it — it leaves the default. The default already excludes the weak ones, and the monitor’s only client here is our own.
Recommended values

The default is sensible; change it only on an external requirement:

Value When
HIGH:!ADH:@STRENGTH (default) always
your own narrowing an audit requirement, and only together with an access check
DEFAULT:@SECLEVEL=0 an old client with a weak certificate, as a targeted exception

Version 1.3 is not configured by this line — it has its own list.

The default and the restriction to versions up to 1.2 are from the manual (§ 3.3.1.58.15). The remark about losing access is ours.
Example configuration
# the default, written out explicitly
http-mgmt-port 1000
http-tls-ciphers HIGH:!ADH:@STRENGTH
The manual’s example. Narrowing makes sense only on an external requirement and after checking that the monitor’s clients still connect.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
▲

Common mistakes and problems

what people get wrong and how it ends3 mistakes▶

Narrowing the list on the management interface for “hardening”

our experience

What it costsStrength does not grow — HIGH already cuts off the weak ones — but a risk of losing access to the node appears. The monitor is the way to reach it, and the fix will have to be done from the console.
How to spot itAfter the configuration is applied, the monitor answers no client at all.
How to do it rightReturn to the default. Test a narrowing on one client before rolling it out to all nodes.

Setting version 1.3 ciphers with this line

§ 3.3.1.58.16

What it costsThe list applies up to and including 1.2. The names of 1.3 suites mean nothing in it, and the needed ones remain at the default.
How to spot itThe list is set, but on 1.3 a suite not from it is negotiated.
How to do it rightPut 1.3 suites into http-tls-v1.3-ciphersuites.

Expecting @STRENGTH to pick the strongest cipher by itself

§ 3.3.1.58.18

What it costsSorting the list only works when the server chooses. By default the client chooses, and the order has no effect.
How to spot itThe list is sorted, but the negotiated suite is not the first one.
How to do it rightSet http-tls-cipher-server-preference to true.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
Reference data
Syntax
http-tls-ciphers <string>
Values
a cipher list string in the notation of the OpenSSL ciphers command
Default
HIGH:!ADH:@STRENGTH § 3.3.1.58.15
Applying
a service restart is required
Queue
will not touch what is already queued
Where to write it
Global
How many times
once in the block
Everything here comes from the manual, with the section.
Inheritance
The directive has no inheritance: it is written at the root of the file, the Global section, and applies to the node’s whole management interface. The mail lists — smtp-server-tls-ciphers for receiving and smtp-tls-ciphers for sending — have nothing to do with the monitor.
⇄

Related directives

4 relations

Depends on

openssl-security-levelGlobalThe security level cuts the weak ones out of this list; the DEFAULT:@SECLEVEL=0 entry inside the list is a targeted substitute for lowering it globally. § 3.3.1.51

Works together with

http-tls-cipher-server-preferenceGlobalThe order in this list decides the matter only when the server chooses. § 3.3.1.58.18http-tls-v1.3-ciphersuitesGlobalThe two lists split the work by protocol version: this one ends at TLS 1.2. § 3.3.1.58.16

Applies to

http-mgmt-portGlobalOne of the settings of the very interface that listens on this port. § 3.3.1.58.15

How to check on the node
We look at which cipher was actually negotiated:
openssl s_client -connect NODE:1000 -tls1_2 -brief </dev/null
The Ciphersuite: line shows the selected suite. A negotiation error in its place means the list is too narrow for this client.
◇

What else to read

3 articles

◇Who is allowed to submit mail and for whom to accept itOut of the box, the node accepts submission only from the machine itself; two different questions — “who can send through us” and “for whose addresses we accept mail” — are answered by different directives.◇The group that grants management rightsMembership in the pmta group gives an unprivileged user the right to call the node’s commands and use submission.◇How the node selects a source and combines its settingsA connection falls under all source blocks whose addresses cover it, and they act merged — the narrow one overrides the wide one; named blocks are attached only by direct reference.

In the Hub
Cost of a mistake
safe: a wrong value breaks nothing
Scenarios
Node security
Neighboring settings of the block Global:smtp-server-tls-certificateopenssl-security-levelsmtp-server-tls-min-versionhttp-tls-min-versionsmtp-server-tls-cipher-server-preferenceAll 108 directives of the block →