Encryption
- Table of Contents
- What level of TLS encryption does your MTA software support for secure email transmission?
- How does your software handle TLS negotiation and certificate management?
What level of TLS encryption does your MTA software support for secure email transmission?
TLS 1.3
For incoming email, the supported list of ciphers is those provided by your OS’s openssl package, which you can get as follows:
/usr/bin/openssl ciphers 'ALL:!PSK:!eNULL:!NULL' | sed 's/:/\n/g' | sort
For outbound email, the supported list of ciphers are listed in this Go file:
https://go.dev/src/crypto/tls/cipher_suites.go
We enable all of the ciphers listed in both CipherSuites() and InsecureCipherSuites().
How does your software handle TLS negotiation and certificate management?
For TLS for outbound SMTP deliveries:
You can control use of STARTTLS for outbound deliveries on a per-IP and/or per-domain basis with the starttls_use and starttls_require configuration directives.
Any SMTP delivery to port 465 will automatically use SMTPS, encrypting the entire connection with TLS. The port of delivery can be configured using the smtp_route directive.
Outbound SMTP deliveries do not use TLS certificates.
For TLS on inbound SMTP deliveries:
By default, GreenArrow offers STARTTLS. This can be disabled.
TLS certificates for inbound mail can also be configured as described here.
See also our documentation of server default TLS certificate.
For HTTPS services
TLS certificates for the HTTPS services can be provided in configuration files or automatically obtained through Let’s Encrypt