X-Git-Url: https://git.ralfj.de/ansible.git/blobdiff_plain/46730acf42cbde7d087b887eb78c3f06dc27d9ca..bb0f118049b0f9e85ff03d74eb81ab7d71bf97aa:/roles/email/templates/dovecot/conf.d/10-ssl.conf

diff --git a/roles/email/templates/dovecot/conf.d/10-ssl.conf b/roles/email/templates/dovecot/conf.d/10-ssl.conf
index 066f372..ae6d354 100644
--- a/roles/email/templates/dovecot/conf.d/10-ssl.conf
+++ b/roles/email/templates/dovecot/conf.d/10-ssl.conf
@@ -9,7 +9,7 @@ ssl = required
 # dropping root privileges, so keep the key file unreadable by anyone but
 # root. Included doc/mkcert.sh can be used to easily generate self-signed
 # certificate, just make sure to update the domains in dovecot-openssl.cnf
-ssl_cert = </etc/ssl/mycerts/letsencrypt/live.crt+chain
+ssl_cert = </etc/ssl/mycerts/letsencrypt/live.crt
 ssl_key = </etc/ssl/private/letsencrypt/live.key
 
 # If key file is password protected, give the password here. Alternatively
@@ -42,11 +42,8 @@ ssl_key = </etc/ssl/private/letsencrypt/live.key
 # auth_ssl_username_from_cert=yes.
 #ssl_cert_username_field = commonName
 
-# DH parameters length to use.
-ssl_dh_parameters_length = 2048
-
-# SSL protocols to use
-ssl_protocols = !SSLv3
+# DH parameters to use
+ssl_dh=</etc/ssl/dh2048.pem
 
 # SSL ciphers to use
 ssl_cipher_list = ALL:!EXPORT:!LOW:!MEDIUM:!kRSA:!kDH:!kECDH:!3DES