# Ssl\_cipher for mail not working

**URL:** <https://www.ruby-forum.com/t/ssl-cipher-for-mail-not-working/236201>\
**Category:** NGINX\
**Created:** [August 14, 2013, 12:57pm UTC](https://www.ruby-forum.com/t/ssl-cipher-for-mail-not-working/236201 "2013-08-14T12:57:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![alcina](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/a587f6/32.png) [@alcina](https://www.ruby-forum.com/u/alcina)\
**Post date:** [August 14, 2013, 12:57pm UTC](https://www.ruby-forum.com/t/ssl-cipher-for-mail-not-working/236201/1 "2013-08-14T12:57:02Z")

</div>

Hello,

to increase security of SSL I added some eliptic-curves-ciphers to the  
chain. For HTTPS it’s working fine, but for the mail proxy it does not  
work,  
I only always get RC4-SHA instead of the ECDH ciphers.  
See configuration at the end of this message.

I’m testing it with:  
openssl s\_client -cipher ‘ECDH:DH’ -connect [domain.de:443](http://domain.de:443)  
openssl s\_client -cipher ‘ECDH:DH’ -connect [imap.domain.de:993](http://imap.domain.de:993)

The first command gives me a successful connection with  
ECDHE-RSA-RC4-SHA,  
so for HTTPS the cipherlist is used. The second command fails with an  
error:  
“sslv3 alert handshake failure”, the IMAPS server does not provide ECDH  
support. I used exactly the same ssl\_cipher line for HTTPS and the mail  
proxy.

When using the following command without forcing any ciphers on the  
client I  
can see that RC4-SHA is the “best” cipher that is supported and used:  
openssl s\_client -connect [imap.domain.de:993](http://imap.domain.de:993)

Anybody has an idea where the problem is?

Thanks in advance  
Michael

================  
mail {  
auth\_http 127.0.0.1/mailauth.php;

proxy on;  
starttls on; ## enable STARTTLS for all mail servers

ssl\_prefer\_server\_ciphers on;  
ssl\_protocols TLSv1.1 TLSv1.2 TLSv1 SSLv3;  
ssl\_ciphers  
ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!CAMELLIA;  
ssl\_session\_cache shared:TLSSL:16m;  
ssl\_session\_timeout 10m;

ssl\_certificate star\_domain\_de.crt;  
ssl\_certificate\_key star\_domain\_de.key;

## default, STARTTLS is appended because of starttls directive above

imap\_capabilities “IMAP4rev1” “LITERAL+” “SASL-IR” “LOGIN-REFERRALS”  
“ID”  
“ENABLE” “IDLE” “NAMESPACE” “AUTH=LOGIN” “AUTH=DIGEST-MD5”  
“AUTH=CRAM-MD5”;  
pop3\_capabilities “TOP” “USER”;

server {  
ssl on;  
listen [::]:993;  
protocol imap;  
server\_name [imap.domain.de](http://imap.domain.de);  
proxy\_pass\_error\_message on;  
}

Posted at Nginx Forum:

> **[ssl\_cipher for mail not working](https://forum.nginx.org/read.php?2,241834,241834#msg-241834)**
>
> Hello, to increase security of SSL I added some eliptic-curves-ciphers to the chain. For HTTPS it's working fine, but for the mail proxy it does not work, I only always get RC4-SHA instead of the ECDH ciphers. See configuration at the end of this...

---

<div class="post-metadata">

**Author:** ![MKl](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/9d8465/32.png) [@MKl](https://www.ruby-forum.com/u/MKl)\
**Post date:** [August 19, 2013, 1:22am UTC](https://www.ruby-forum.com/t/ssl-cipher-for-mail-not-working/236201/2 "2013-08-19T01:22:20Z")

</div>

Hello!

On Wed, Aug 14, 2013 at 06:56:32AM -0400, MKl wrote:

> Anybody has an idea where the problem is?  
> Looks like the problem fixed by this changeset:

[http://trac.nginx.org/nginx/changeset/32fe021911c9/nginx](http://trac.nginx.org/nginx/changeset/32fe021911c9/nginx)

Should work fine in nginx 1.5.1+.

[…]

–  
Maxim D.

> **[nginx: donation](http://nginx.org/en/donation.html)**

---

<div class="post-metadata">

**Author:** ![MKl](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/9d8465/32.png) [@MKl](https://www.ruby-forum.com/u/MKl)\
**Post date:** [August 19, 2013, 12:05pm UTC](https://www.ruby-forum.com/t/ssl-cipher-for-mail-not-working/236201/3 "2013-08-19T12:05:14Z")

</div>

## Maxim D. Wrote:

> Looks like the problem fixed by this changeset:
> 
> [http://trac.nginx.org/nginx/changeset/32fe021911c9/nginx](http://trac.nginx.org/nginx/changeset/32fe021911c9/nginx)
> 
> Should work fine in nginx 1.5.1+.

Hi Maxim,

thanks for your answer! I will try this later.  
Will this also be merged into 1.4 or even 1.2 branch? Because it’s a  
bugfix  
and not a new feature?  
Currently we have the problem that the upload-module and  
upload-progress-module are not working with \>=1.4, so we are still on  
1.2  
branch.

Thank you again for your help and work on nginx!  
Michael

Posted at Nginx Forum:  
[http://forum.nginx.org/read.php?2,241834,242014#msg-242014](http://forum.nginx.org/read.php?2,241834,242014#msg-242014)

---

<div class="post-metadata">

**Author:** ![MKl](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/9d8465/32.png) [@MKl](https://www.ruby-forum.com/u/MKl)\
**Post date:** [August 19, 2013, 12:57pm UTC](https://www.ruby-forum.com/t/ssl-cipher-for-mail-not-working/236201/4 "2013-08-19T12:57:13Z")

</div>

Hello!

On Mon, Aug 19, 2013 at 06:04:49AM -0400, MKl wrote:

> thanks for your answer! I will try this later.  
> Will this also be merged into 1.4 or even 1.2 branch? Because it’s a bugfix  
> and not a new feature?

Certainly not into 1.2.x, it’s obsolete. Most likely not into  
1.4.x as it’s never worked in previous versions.

–  
Maxim D.

> **[nginx: donation](http://nginx.org/en/donation.html)**