Open sebastianlipponer opened 2 years ago
That's misconfiguration on Amazon side
Yes, indeed, I reported this also to AWS. Hopefully they will fix it soon. However, I just wonder, given the widespread use of Amazon SES, whether it is a good idea to recommend this configuration for almost all systems since I guess the transfer happens in plain text then.
ECDHE-RSA-AES256-SHA384
To clarify, this cipher has forward secrecy and is generally fine, but the main concern for it not being part of intermediate
is due to using CBC which has proven to be less reliably secure than AEAD ciphers right?
In practice, it's fine to use AFAIK, should no better ciphers be available, but without the cipher list containing all AEAD ciphers; it is then advised to require server preference in cipher choice, not client preference? (thus order in list matters)
Using Postfix 3.5.6 (Debian Bullseye) with the intermediate configuration and a RSA certificate I see this error with mails received via Amazon SES:
I also found this excellent blog post. According to the author adding
ECDHE-RSA-AES256-SHA384
to the cipher list solves the problem.