search

flashmob / go-guerrilla

Mini SMTP server written in golang
MIT License
2.79k stars 366 forks source link

SSL support without nginx #12

Closed lllama closed 8 years ago

lllama commented 8 years ago

Some clients are refusing to connect over SSL due to either v2 not being supported, or v3 not agreeing a cipher. Is there some config change required to allow other ciphers, or is nginx still required to handle STARTTLS connections?

flashmob commented 8 years ago

Yes, there is still a significant number of senders attempting to use SSLv2, even though it is noted to be vulnerable, see DROWN attack https://drownattack.com Similar issues with SSLv3. If you want to support these legacy protocols (not recommended) then proxying via nginx would be required.

xeoncross commented 8 years ago

See commit 5cd2a8ca31 for information about past support for these bad ciphers which was removed.

lllama commented 8 years ago

Thanks for the responses. Unfortunately, we need to be fairly permissive with what we allow, as we want to make sure we don't miss any mail. Looks like nginx is the solution for now.