Demo
Demo

Knowledge base

PMTA knowledge base›Block Global›Directive§ 3.3.1.51

openssl-security-level

Global

The OpenSSL security threshold for the whole node
in the configuration this is a lineopenssl-security-level 1inside the block Global
A common threshold below which the node does not work

Since version 6.0 PowerMTA ships with OpenSSL 3.0 inside, and it rejects much of what used to pass: weak signature algorithms, short keys — DKIM keys included — and protocol versions below 1.2. The threshold is set as a number from 0 to 5, the default is 1.

The symptom is that the node does not start. A key or certificate that is too weak stops startup rather than dropping a single connection. The manual gives two typical errors: ca md too weak — the certificate is signed with an obsolete algorithm; tlsv1 alert internal error with number 80 — the other side’s certificate is too weak.

The right cure is reissuing, not lowering the threshold. The manual says so directly: lower it when reissuing right now is impossible. The threshold is common to the whole node and lowers the bar for everything at once — signing, receiving, sending and the management interface.

There is a targeted alternative. The entry DEFAULT:@SECLEVEL=0 inside a cipher list — smtp-tls-ciphers, for example — lowers the level only for that list. Both methods work by position in the file: the lowering must come above the certificate line it applies to.

We see the same mechanics from the other side. When checking a node with openssl s_client, it is easy to get a refusal from your own client rather than from the node: no protocols available means the local security level refused to offer the old version. It is lifted with the same trick: -cipher ‘DEFAULT:@SECLEVEL=0’.

The main trap is lowering the threshold and leaving it forever. It is common: one weak chain at one receiver lowers the bar for the whole node, including message signing and the management interface. The line does nothing to remind you of itself — it is simply there, and a year later nobody remembers why.
What the Hub does. It does not write it: nodes are installed from scratch, and keys and certificates are issued by us and pass the threshold. The line is needed when moving someone else’s configuration to a new node — and there it should be treated as temporary, with a reissue task.
Recommended values

Lowering is a last resort, and a targeted one is better:

Value When
1 (default) always
0 the node does not start, and reissuing right now is impossible
2 and higher an external security requirement, with delivery verification

A targeted alternative to a general lowering is DEFAULT:@SECLEVEL=0 in the relevant cipher list, above the corresponding certificate line.

The range, the default of 1, both example errors and the positional behavior come from the manual (§ 3.3.1.51). The advice to treat lowering as temporary and create a reissue task is ours. The remark about your own client refusing during a check is our observation.
Example configuration
# last resort: the node does not start with the old certificate,
# reissue is scheduled — remove before the end of the quarter
openssl-security-level 0smtp-server-tls-certificate /etc/pmta/legacy.pem
The order matters: the lowering comes above the certificate line it applies to. The comment with a deadline is part of the measure; otherwise it will stay forever.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
▲

Common mistakes and problems

what people get wrong and how it ends3 mistakes▶

Lowering the threshold for the whole node because of one weak certificate

§ 3.3.1.51

What it costsThe bar is lowered for everything at once: message signing, receiving, sending and the management interface. The whole node is weakened for the sake of one chain.
How to spot itThe file has openssl-security-level 0, while there is only one weak spot.
How to do it rightUse DEFAULT:@SECLEVEL=0 in the relevant cipher list — above the corresponding certificate line.

Putting the lowering below the certificate line

§ 3.3.1.51

What it costsBoth methods work positionally. Below means after the certificate has already been read and rejected, and startup will fail anyway.
How to spot itThe line is there, yet the node still does not start, with the same error.
How to do it rightMove the line above the certificate it applies to.

Assuming a system update will raise the threshold

our experience

What it costsOpenSSL comes inside the PowerMTA distribution. Updating the operating system’s libraries does not affect its behavior — in either direction.
How to spot itAfter the system update the OpenSSL errors remain the same.
How to do it rightChange only the PowerMTA version, or reissue the keys and certificates.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
Reference data
Syntax
openssl-security-level N
Values
an integer from 0 to 5
Default
1 § 3.3.1.51
Applying
reload, no restart needed
Queue
will not touch what is already queued
Where to write it
Global
How many times
once in the block
Everything here comes from the manual, with the section.
Inheritance
The directive has no inheritance: it is written at the root of the file, in the Global section, and applies to the whole node. But it acts positionally — on the lines that come after it — and this sets it apart from other node-level settings.
⇄

Related directives

3 relations

Can be replaced by

smtp-server-tls-ciphersGlobalThe DEFAULT:@SECLEVEL=0 entry in a cipher list does the same thing, but in a targeted way — for one list rather than the whole node. § 3.3.1.51

Affects

smtp-server-tls-certificateGlobalA weak receiving certificate is the most common reason the node does not start and the level gets lowered. § 3.3.1.51Upgrading the engineMoving to PowerMTA 6 from an earlier version is the moment when old keys and certificates are first checked by the new OpenSSL. § 3.3.1.51

Referenced from

smtp-server-tls-min-versionGlobalThe library’s security level may forbid a version before this setting even comes into play. § 3.3.1.51http-tls-min-versionGlobalThe OpenSSL security level may refuse a version this bound allows. inferencehttp-tls-ciphersGlobalThe security level cuts the weak ones out of this list; the DEFAULT:@SECLEVEL=0 entry inside the list is a targeted substitute for lowering it globally. § 3.3.1.51smtp-tls-min-version<domain>The library’s security level may forbid a version before this setting even comes into play. § 3.3.1.51The encryption library is part of the distribution, not the systemThe only setting of the built-in library: it allows or forbids whole classes of ciphers and versions. § 2.8

How to check on the node
The value in force is a line in the configuration; with no line, the default applies:
grep -rn 'openssl-security-level' /etc/pmta/
A value of 0 in a working configuration is a reason to look for the key reissue task. If the node does not start at all, look not here but in the log: both typical OpenSSL errors are printed there verbatim.
◇

What else to read

3 articles

◇The encryption library is part of the distribution, not the systemOpenSSL comes inside the PowerMTA distribution, so the set of versions and ciphers is determined by the product version, not by system libraries.◇The activation key is a prerequisite for installation, not a step after itWithout an activation key from SparkPost support the engine neither installs nor runs, and the license tier sets the outbound connection ceiling: on Standard everything above 200 is ignored.◇Cloud restrictionsClouds restrict outbound mail on port 25 until you ask them to lift the limit, and mailbox providers treat their address ranges with suspicion.

In the Hub
Cost of a mistake
dangerous: effects outlast a rollback
Scenarios
Prepare a node for sending · Connection encryption
Neighboring settings of the block Global:smtp-server-tls-certificatesmtp-server-tls-min-versionhttp-tls-min-versionsmtp-server-tls-cipherssmtp-server-tls-cipher-server-preferenceAll 108 directives of the block →