<div dir="ltr">I still don't reproduce the bug.<div><br></div><div style>I do:</div><div style>$ openssl s_client -cipher ECDHE-RSA-AES256-SHA -connect localhost:465</div><div style>or</div><div style><div>$ openssl s_client -cipher ECDHE-RSA-AES256-SHA -connect localhost:25 -starttls smtp</div>
<div><br></div></div><div style><br></div><div style>And it seems to work fine:</div><div style><div><div>Apr 25 23:01:19 solaris11-vm postfix/smtps/smtpd[1466]: [ID 197553 <a href="http://mail.info">mail.info</a>] Anonymous TLS connection established from <a href="http://solaris11-vm.pleiades.fr.eu.org">solaris11-vm.pleiades.fr.eu.org</a>[127.0.0.1]: TLSv1.2 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)</div>
</div><div><br></div><div><div>Apr 25 23:02:02 solaris11-vm postfix/smtpd[1448]: [ID 197553 <a href="http://mail.info">mail.info</a>] Anonymous TLS connection established from <a href="http://solaris11-vm.pleiades.fr.eu.org">solaris11-vm.pleiades.fr.eu.org</a>[127.0.0.1]: TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)</div>
</div><div><br></div><div>ECDHE-RSA-AES256-SHA use the SHA1 algorithm.<br></div><div><br></div><div style><br></div><div style>What is the client used to trigger the problem ?</div><div style><br></div><div style>Yann</div>
<div style><br></div><div style><br></div><div><br></div></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">2013/4/25 Juraj Lutter <span dir="ltr"><<a href="mailto:wilbury@opencsw.org" target="_blank">wilbury@opencsw.org</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">On 04/25/2013 05:45 PM, Yann Rouillard wrote:<br>
> Hi Juraj,<br>
><br>
> sha1 seems to be available:<br>
> $ openssl dgst -sha1 /tmp/file<br>
> SHA1(/tmp/file)= da39a3ee5e6b4b0d3255bfef95601890afd80709<br>
><br>
> I don't reproduce your bug.<br>
> Can you send me your postfix configuration ?<br>
<br>
</div>Relevant lines are:<br>
<br>
smtpd_tls_security_level = may<br>
smtpd_tls_auth_only = no<br>
smtpd_tls_key_file = /etc/opt/ows/postfix/ssl1/mailhub.ltc.sk.key<br>
smtpd_tls_cert_file = /etc/opt/ows/postfix/ssl1/mailhub.ltc.sk.crt<br>
smtpd_tls_CApath = /etc/opt/csw/ssl/certs<br>
smtpd_tls_loglevel = 1<br>
smtpd_tls_received_header = yes<br>
smtpd_tls_session_cache_timeout = 3600s<br>
smtpd_tls_cipherlist = ALL:!aNULL:!eNULL:!LOW:!SSLv2:TLSv1:SSLv3:+EXP<br>
smtpd_tls_ask_ccert = yes<br>
smtpd_tls_req_ccert = no<br>
smtpd_tls_protocols = !SSLv2,SSLv3,TLSv1<br>
relay_clientcerts = dbm:/etc/opt/ows/postfix/relay_clientcerts<br>
tls_random_source = dev:/dev/urandom<br>
<br>
it's been working FOR YEARS, until yesterday when I've upgraded OpenSSL.<br>
<br>
:-(<br>
<br>
><br>
><br>
> Yann<br>
><br>
><br>
><br>
><br>
><br>
><br>
> 2013/4/25 Juraj Lutter <<a href="mailto:wilbury@opencsw.org">wilbury@opencsw.org</a> <mailto:<a href="mailto:wilbury@opencsw.org">wilbury@opencsw.org</a>>><br>
<div class="im">><br>
> Hi,<br>
><br>
> after recent OpenSSL upgrade, my postfix started to yield following:<br>
><br>
> Apr 25 10:09:31 filesrv1 postfix-ltc-ssl/smtpd[24885]: [ID 947731<br>
> mail.warning] warning: Digest algorithm "sha1" not found: disabling TLS<br>
> support<br>
><br>
><br>
> Have anyone of you also encountered this kind of behaviour?<br>
><br>
> Thanks.<br>
><br>
> --<br>
> Juraj Lutter<br>
> URL: <a href="http://www.wilbury.sk/" target="_blank">http://www.wilbury.sk/</a><br>
</div>> XMPP: <a href="mailto:juraj@lutter.sk">juraj@lutter.sk</a> <mailto:<a href="mailto:juraj@lutter.sk">juraj@lutter.sk</a>><br>
<div class="im">> Pekny, mily a usmievavy webhosting a serverhousing: <a href="http://www.nic.sk/" target="_blank">http://www.nic.sk/</a><br>
><br>
> _______________________________________________<br>
> maintainers mailing list<br>
</div>> <a href="mailto:maintainers@lists.opencsw.org">maintainers@lists.opencsw.org</a> <mailto:<a href="mailto:maintainers@lists.opencsw.org">maintainers@lists.opencsw.org</a>><br>
<div class="im HOEnZb">> <a href="https://lists.opencsw.org/mailman/listinfo/maintainers" target="_blank">https://lists.opencsw.org/mailman/listinfo/maintainers</a><br>
> .:: This mailing list's archive is public. ::.<br>
><br>
><br>
><br>
><br>
> _______________________________________________<br>
> maintainers mailing list<br>
> <a href="mailto:maintainers@lists.opencsw.org">maintainers@lists.opencsw.org</a><br>
> <a href="https://lists.opencsw.org/mailman/listinfo/maintainers" target="_blank">https://lists.opencsw.org/mailman/listinfo/maintainers</a><br>
> .:: This mailing list's archive is public. ::.<br>
><br>
<br>
<br>
</div><span class="HOEnZb"><font color="#888888">--<br>
Juraj Lutter <<a href="mailto:wilbury@opencsw.org">wilbury@opencsw.org</a>><br>
</font></span><div class="HOEnZb"><div class="h5">_______________________________________________<br>
maintainers mailing list<br>
<a href="mailto:maintainers@lists.opencsw.org">maintainers@lists.opencsw.org</a><br>
<a href="https://lists.opencsw.org/mailman/listinfo/maintainers" target="_blank">https://lists.opencsw.org/mailman/listinfo/maintainers</a><br>
.:: This mailing list's archive is public. ::.<br>
</div></div></blockquote></div><br></div>