Demo
Demo

Knowledge base

PMTA knowledge base›Mechanism§ 14

Third-party components of the engine

third-party components
The expression dialect and cryptography are not its own

The manual’s acknowledgements are an inventory of components: PCRE defines the regular expression dialect, OpenSSL — TLS and cryptography, ICU — Unicode handling, gumbo-parser — HTML parsing for tracking, prometheus-cpp — serving metrics.

The manual’s wording is “uses, and may in its distribution kits include”: the engine uses the libraries and may carry them in its distribution. For OpenSSL this is directly visible: version 6.0 runs on OpenSSL 3.0.8, and the openssl utility and the FIPS module from the distribution are in /var/lib/pmta/fips.

The manual gives no versions for the other libraries.

The main trap is checking the system OpenSSL. openssl version on the machine speaks about the system library, while engine 6.0 runs on OpenSSL 3.0.8 — and negotiates ciphers by its rules.
What the Hub does. There is nothing to configure here. The knowledge is useful during diagnosis: the node’s ciphers are determined by the engine’s OpenSSL, not the system one.
Recommended values

Five libraries:

Library What it determines
PCRE regular expressions
OpenSSL TLS and cryptography
ICU Unicode
gumbo-parser HTML parsing for tracking
prometheus-cpp metrics for Prometheus
The five libraries and the distribution wording come from the manual (§ 14); OpenSSL 3.0.8 and the FIPS module directory are § 2.8. The analysis is ours.
Example configuration
# which engine build to compare during diagnosis
pmta show version
The node’s capabilities are a property of this build: two nodes with different version strings may differ in them.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
⇄

Related entries

2 relations

Works together with

What is not allowed in FIPS modeA related mechanism: they work together. § 2.8

Applies to

Selecting a sending address by message contentA related mechanism: they work together. § 3.3.14

How to check on the node
Compare the engine’s OpenSSL and the system one:
/var/lib/pmta/fips/openssl version
openssl version
The first line is OpenSSL from the engine’s distribution, the second is the system one; for TLS diagnosis the first one matters.
◇

What else to read

3 articles

◇The directive indexThe manual’s alphabetical index: 475 lines name 477 places where directives are documented — the only complete inventory of the configuration language.◇Accept, route, deliverA message’s path inside the node: accept, decide where, deliver — and all the settings live between these three steps.◇The activation key is a prerequisite for installation, not a step after itWithout an activation key from SparkPost support the engine neither installs nor runs, and the license tier sets the outbound connection ceiling: on Standard everything above 200 is ignored.

In the Hub
Cost of a mistake
safe: a wrong value breaks nothing
Scenarios
Configuration lifecycle · Troubleshoot deliverability · Prepare a node for sending