Demo
Demo

Knowledge base

PMTA knowledge base›Block Global›Directive§ 3.3.1.58.16

http-tls-v1.3-ciphersuites

Globalrestart required

The web monitor's cipher suites for TLS 1.3
in the configuration this is a linehttp-tls-v1.3-ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_SHA256:TLS_AES_128_CCM_8_SHA256inside the block Global
Monitor ciphers on version 1.3

A separate list — because in version 1.3 suites are structured differently than in earlier ones, and there is no common notation for them. http-tls-ciphers does not apply to 1.3.

The default lists five suites — from TLS_AES_256_GCM_SHA384 to TLS_AES_128_CCM_8_SHA256. We checked on a fleet node: the monitor negotiates the first of them.

All five are modern. Version 1.3 has no weak suites — the committee threw them out of the standard rather than leaving them to the administrator’s discretion. There is nothing to narrow the list for “hardening” here.

The main trap is narrowing to a single suite. Strength will not grow, but compatibility will drop: a client without this suite will not negotiate version 1.3 at all and will either fall back to 1.2 or fail to connect.
What the Hub does. It does not write it: all five default suites are fine, and there is nothing to choose between.
Recommended values

The line is rarely needed — by policy requirement, not for strength:

Value When
do not set (default) always
two or three suites an external policy requirement
one suite never

The value is suite names separated by colons, as OpenSSL prints them.

The five-suite default and the separation from the list for versions up to 1.2 are from the manual (§ 3.3.1.58.16). That the monitor takes the first of them is our check on a fleet node. The advice not to narrow to one is ours.
Example configuration
# narrowing to two suites — by policy requirement, not “for hardening”
http-mgmt-port 1000
http-tls-v1.3-ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
The manual’s example. Both suites are strong; the point of the line is conformity to someone else’s list, not better encryption.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
▲

Common mistakes and problems

what people get wrong and how it ends2 mistakes▶

Narrowing to one suite “for hardening”

our experience

What it costsStrength does not grow — all five suites are modern — but compatibility drops: a client without this suite falls back to 1.2 or fails to connect.
How to spot itSome of the monitor’s clients suddenly connect over 1.2.
How to do it rightReturn the default or leave at least two suites.

Writing cipher names from the list for versions up to 1.2 here

§ 3.3.1.58.15

What it costsEntries like HIGH or ECDHE-RSA-AES256-GCM-SHA384 are not understood by version 1.3. The list will turn out empty, and negotiation over 1.3 will stop succeeding.
How to spot itProtocol version: TLSv1.2 where there used to be 1.3.
How to do it rightPut only names like TLS_* here, and the older ones into http-tls-ciphers.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
Reference data
Syntax
http-tls-v1.3-ciphersuites <string>
Values
a list of TLS 1.3 suites, colon-separated
Default
TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_SHA256:TLS_AES_128_CCM_8_SHA256 § 3.3.1.58.16
Applying
a service restart is required
Queue
will not touch what is already queued
Where to write it
Global
How many times
once in the block
Everything here comes from the manual, with the section.
Inheritance
The directive has no inheritance: it is written at the root of the file, the Global section, and applies to the node’s whole management interface.
⇄

Related directives

2 relations

Works together with

http-tls-cipher-server-preferenceGlobalThe order here decides the matter only when the server chooses. § 3.3.1.58.18

Applies to

http-mgmt-portGlobalOne of the settings of the very interface that listens on this port. § 3.3.1.58.16

Referenced from

http-tls-ciphersGlobalThe two lists split the work by protocol version: this one ends at TLS 1.2. § 3.3.1.58.16

How to check on the node
We look at which suite was negotiated on version 1.3:
openssl s_client -connect NODE:1000 -tls1_3 -brief </dev/null
The Ciphersuite: line shows the selected suite. If it is not from your list, the connection went over a different protocol version — check Protocol version in the same output.
◇

What else to read

3 articles

◇Who is allowed to submit mail and for whom to accept itOut of the box, the node accepts submission only from the machine itself; two different questions — “who can send through us” and “for whose addresses we accept mail” — are answered by different directives.◇The group that grants management rightsMembership in the pmta group gives an unprivileged user the right to call the node’s commands and use submission.◇How the node selects a source and combines its settingsA connection falls under all source blocks whose addresses cover it, and they act merged — the narrow one overrides the wide one; named blocks are attached only by direct reference.

In the Hub
Cost of a mistake
safe: a wrong value breaks nothing
Scenarios
Node security
Neighboring settings of the block Global:smtp-server-tls-certificateopenssl-security-levelsmtp-server-tls-min-versionhttp-tls-min-versionsmtp-server-tls-cipher-server-preferenceAll 108 directives of the block →