tighter spam control needed

[ansible.git] / roles / email / templates / dovecot / conf.d / 10-ssl.conf

diff --git a/roles/email/templates/dovecot/conf.d/10-ssl.conf b/roles/email/templates/dovecot/conf.d/10-ssl.conf
index 066f3722071b64ae073cd446cb7a9802e63fe8fc..ae6d35400b22b89d3a0e1457cfeddca45cb30d36 100644 (file)
--- a/roles/email/templates/dovecot/conf.d/10-ssl.conf
+++ b/roles/email/templates/dovecot/conf.d/10-ssl.conf
@@ -9,7 +9,7 @@ ssl = required
 # dropping root privileges, so keep the key file unreadable by anyone but
 # root. Included doc/mkcert.sh can be used to easily generate self-signed
 # certificate, just make sure to update the domains in dovecot-openssl.cnf
 # dropping root privileges, so keep the key file unreadable by anyone but
 # root. Included doc/mkcert.sh can be used to easily generate self-signed
 # certificate, just make sure to update the domains in dovecot-openssl.cnf

-ssl_cert = </etc/ssl/mycerts/letsencrypt/live.crt+chain
+ssl_cert = </etc/ssl/mycerts/letsencrypt/live.crt

 ssl_key = </etc/ssl/private/letsencrypt/live.key
 
 # If key file is password protected, give the password here. Alternatively
 ssl_key = </etc/ssl/private/letsencrypt/live.key
 
 # If key file is password protected, give the password here. Alternatively


@@ -42,11 +42,8 @@ ssl_key = </etc/ssl/private/letsencrypt/live.key
 # auth_ssl_username_from_cert=yes.
 #ssl_cert_username_field = commonName
 
 # auth_ssl_username_from_cert=yes.
 #ssl_cert_username_field = commonName
 

-# DH parameters length to use.
-ssl_dh_parameters_length = 2048
-
-# SSL protocols to use
-ssl_protocols = !SSLv3
+# DH parameters to use
+ssl_dh=</etc/ssl/dh2048.pem

 
 # SSL ciphers to use
 ssl_cipher_list = ALL:!EXPORT:!LOW:!MEDIUM:!kRSA:!kDH:!kECDH:!3DES
 
 # SSL ciphers to use
 ssl_cipher_list = ALL:!EXPORT:!LOW:!MEDIUM:!kRSA:!kDH:!kECDH:!3DES