# DANE DNS-SEC TLSA on RR smtp.domain.tld **URL:** \ **Category:** Support Debian\ **Tags:** securité, mail, dns\ **Created:** [Novembre 9, 2023, 4:08 UTC](https://www.debian-fr.org/t/dane-dns-sec-tlsa-on-rr-smtp-domain-tld/89117 "2023-11-09T16:08:43Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![anon36725218](https://www.debian-fr.org/letter_avatar_proxy/v4/letter/a/8e8cbc/32.png) [@anon36725218](https://www.debian-fr.org/u/anon36725218)\ **Post date:** [Novembre 9, 2023, 4:08 UTC](https://www.debian-fr.org/t/dane-dns-sec-tlsa-on-rr-smtp-domain-tld/89117/1 "2023-11-09T16:08:43Z")
Bonjour, depuis 2 jours je reçois des mails provenant de [DNSSEC-DANE-Deployment-Statistics](https://stats.dnssec-tools.org/) qui me signale que mon serveur de mail n’est pas valide DANE - cela depuis (je pense) que j’ai fait des tests de bonne configuration d’email depuis le siteweb [https://internet.nl](https://internet.nl) - en fait je crois que cela vient de mon register de domaine [gandi.net](http://gandi.net) 😉 ``` De : DANE Survey Notices Pour : 7331b9..........39736938@contact.gandi.net Copie à : hostmaster@lab3w.fr (moi) Sujet : [Reminder] smtp.zw3b.eu[158.69.126.137], smtp.zw3b.net[2607:5300:60:9389:17:4c1:0:1a]: SMTP server DNS (DANE TLSA record) issue ``` çà pète, en passant 😊 CF : [https://stats.dnssec-tools.org/explore/?zw3b.eu](https://stats.dnssec-tools.org/explore/?zw3b.eu) Par contre j’ai l’impression qu’il y a un bug de vérification DANE ; on dirait que le site vérifie le port `_443._tcp` sur le nom SMTP (c’est un peu c\*\* c\*\*) 😃 J’ai un serveur mail « mail.zw3b.eu ». Le protocol SMTP (25) & SMTPs (465) & SMTPs STARTLS (587) (donc) sont valident DANE. ``` $ dig TLSA _25._tcp.smtp.zw3b.eu @dns.google +short 3 0 1 6A42E98D3EADBB58C37A4127CEF3BB8BD004AC8DA39EE14F46549E52 C75F1C4F $ dig TLSA _465._tcp.smtp.zw3b.eu @dns.google +short 3 0 1 6A42E98D3EADBB58C37A4127CEF3BB8BD004AC8DA39EE14F46549E52 C75F1C4F $ dig TLSA _587._tcp.smtp.zw3b.eu @dns.google +short 3 0 1 6A42E98D3EADBB58C37A4127CEF3BB8BD004AC8DA39EE14F46549E52 C75F1C4F ``` Le webmail HTTPs (TLS) (donc) valide DANE. ``` $ dig TLSA _443._tcp.webmail.zw3b.eu @dns.google +short 3 0 1 6A42E98D3EADBB58C37A4127CEF3BB8BD004AC8DA39EE14F46549E52 C75F1C4F ``` Est-ce la bonne configuration ? Il me semble bien - n’est-ce pas ? * * * Je pourrais ajouter un enregistrement DNS pour cette question (mais je ne vois pas à quoi çà sert) : ``` $ dig TLSA _443._tcp.smtp.zw3b.eu @dns.google +short ``` Merci pour vos réponses. Salutations, Romain * * * J’ajoute çà : Sur le service « webmail.zw3b.eu:443 » : ``` $ echo | openssl s_client -showcerts -servername webmail.zw3b.eu -connect webmail.zw3b.eu:443 2>/dev/null | openssl x509 -inform pem -noout -text Certificate: Data: Version: 3 (0x2) Serial Number: 04:03:b6:45:1d:b1:5f:11:2e:8c:ac:d0:af:9c:15:e9:67:fe Signature Algorithm: sha256WithRSAEncryption Issuer: C = US, O = Let's Encrypt, CN = R3 Validity Not Before: Nov 7 15:26:37 2023 GMT Not After : Feb 5 15:26:36 2024 GMT Subject: CN = mail.zw3b.eu Subject Public Key Info: Public Key Algorithm: id-ecPublicKey Public-Key: (384 bit) pub: 04:12:c1:14:2c:d2:45:d6:92:82:10:b5:27:58:3d: d2:10:80:40:2d:a4:07:b5:6e:2f:9c:91:72:cb:cd: a3:1e:09:ec:75:08:f5:41:37:0c:9e:0d:a6:fe:89: e5:41:3f:77:48:54:a6:35:15:4f:95:b9:82:c9:42: 8e:f6:ff:cd:f4:3a:be:77:3f:af:d4:04:40:a0:33: cf:65:15:52:30:e4:ea:e3:0a:72:9b:6a:41:1a:54: 9a:bd:52:ee:6b:d4:ec ASN1 OID: secp384r1 NIST CURVE: P-384 X509v3 extensions: X509v3 Key Usage: critical Digital Signature X509v3 Extended Key Usage: TLS Web Server Authentication, TLS Web Client Authentication X509v3 Basic Constraints: critical CA:FALSE X509v3 Subject Key Identifier: FF:D3:55:B5:EB:0C:84:A0:8B:A7:3C:04:38:73:8F:02:9D:C1:9E:8D X509v3 Authority Key Identifier: keyid:14:2E:B3:17:B7:58:56:CB:AE:50:09:40:E6:1F:AF:9D:8B:14:C2:C6 Authority Information Access: OCSP - URI:http://r3.o.lencr.org CA Issuers - URI:http://r3.i.lencr.org/ X509v3 Subject Alternative Name: DNS:imap.zw3b.blog, DNS:imap.zw3b.com, DNS:imap.zw3b.eu, DNS:imap.zw3b.fr, DNS:imap.zw3b.net, DNS:imap.zw3b.site, DNS:imap.zw3b.tv, DNS:mail.zw3b.blog, DNS:mail.zw3b.com, DNS:mail.zw3b.eu, DNS:mail.zw3b.fr, DNS:mail.zw3b.net, DNS:mail.zw3b.site, DNS:mail.zw3b.tv, DNS:pop.zw3b.blog, DNS:pop.zw3b.com, DNS:pop.zw3b.eu, DNS:pop.zw3b.fr, DNS:pop.zw3b.net, DNS:pop.zw3b.site, DNS:pop.zw3b.tv, DNS:smtp.zw3b.blog, DNS:smtp.zw3b.com, DNS:smtp.zw3b.eu, DNS:smtp.zw3b.fr, DNS:smtp.zw3b.net, DNS:smtp.zw3b.site, DNS:smtp.zw3b.tv, DNS:webmail.zw3b.blog, DNS:webmail.zw3b.com, DNS:webmail.zw3b.eu, DNS:webmail.zw3b.fr, DNS:webmail.zw3b.net, DNS:webmail.zw3b.site, DNS:webmail.zw3b.tv X509v3 Certificate Policies: Policy: 2.23.140.1.2.1 CT Precertificate SCTs: Signed Certificate Timestamp: Version : v1 (0x0) Log ID : 3B:53:77:75:3E:2D:B9:80:4E:8B:30:5B:06:FE:40:3B: 67:D8:4F:C3:F4:C7:BD:00:0D:2D:72:6F:E1:FA:D4:17 Timestamp : Nov 7 16:26:38.263 2023 GMT Extensions: none Signature : ecdsa-with-SHA256 30:45:02:21:00:94:67:2C:65:F1:F5:7F:18:4B:D8:A5: 78:67:B1:D3:83:8B:E3:0F:4E:0B:86:02:DE:B8:42:95: 55:6E:1D:70:0F:02:20:37:25:80:CE:A2:82:CD:BF:C8: DC:4B:FB:75:BA:B7:89:A6:7C:2D:36:B5:8B:C9:7F:45: 30:B0:6C:F6:6C:2A:52 Signed Certificate Timestamp: Version : v1 (0x0) Log ID : EE:CD:D0:64:D5:DB:1A:CE:C5:5C:B7:9D:B4:CD:13:A2: 32:87:46:7C:BC:EC:DE:C3:51:48:59:46:71:1F:B5:9B Timestamp : Nov 7 16:26:38.323 2023 GMT Extensions: none Signature : ecdsa-with-SHA256 30:46:02:21:00:CD:35:50:C5:E3:D5:DF:4C:D5:C0:A6: D0:B8:34:2F:74:32:28:7C:24:49:E8:A0:8E:4B:97:02: C0:10:47:EB:BC:02:21:00:8A:28:D3:A3:34:CE:25:B6: 54:34:E7:28:AF:BC:54:86:7A:B9:F8:53:20:BE:03:68: 55:8B:56:55:84:F8:D7:38 Signature Algorithm: sha256WithRSAEncryption 33:5f:6c:4b:6e:b5:de:5c:bc:5a:62:f4:93:7f:cc:c7:aa:4e: 41:f1:b9:d6:48:58:ec:d9:8f:d8:66:26:f1:d0:5a:9e:3a:0c: 35:bf:9c:9a:74:53:fe:b1:1a:32:a8:65:15:74:04:49:da:68: 1e:db:ff:84:3e:58:14:f0:71:8e:25:1d:45:1e:28:3f:ea:17: 16:4f:0b:51:04:c0:5d:c4:94:72:73:10:5f:4c:a8:4a:1a:a6: 84:31:fa:b1:3b:f3:69:50:79:74:4b:0d:ca:6a:11:82:1f:bf: 26:be:d7:35:3d:f1:ae:67:e8:c6:a5:56:21:36:7c:07:46:96: 8e:83:b5:9d:27:16:ae:68:2e:48:94:57:f3:b0:ff:fe:f6:81: e6:c7:91:3c:36:5c:69:ac:02:0d:00:4b:e0:3c:9b:bf:2f:41: 85:a8:c1:26:2c:6a:f5:fd:d3:06:02:b7:89:84:76:65:a9:22: 88:67:1a:98:ee:8b:25:74:54:c5:4a:15:45:0f:7d:32:9f:d8: 10:de:42:44:25:3d:65:1d:9d:98:f5:5b:b4:4e:08:44:ba:4c: 1e:02:52:ff:c8:55:ba:f5:0c:8e:8c:d4:4a:e3:da:a0:1d:b4: b4:fb:13:2a:4c:2f:11:40:5c:02:81:e6:ec:2b:d2:66:1f:d2: 68:a1:c1:0b ``` Sur le service « smtp.zw3b.eu:25 » : ``` $ echo | openssl s_client -showcerts -servername smtp.zw3b.eu -connect smtp.zw3b.eu:25 -6 2>/dev/null | openssl x509 -inform pem -noout -text unable to load certificate 140013873140928:error:0909006C:PEM routines:get_name:no start line:../crypto/pem/pem_lib.c:745:Expecting: TRUSTED CERTIFICATE ``` ? Aurais-je fais une bourde (pourtant j’arrive normalement à m’authentifier avec mon logiciel de mails Mozilla Thunderbird à recevoir et send)… J’ai pû lire que par exemple les signatures DKIM peuvent être au maximum en ec-256 plutôt _ed25519-sha256_ et non pas en ec-384 mais je ne crois pas ce soit la même chose pour le protocol SMTP. Je ne sais pas exactement. Pour DKIM : - Algorithm RSA-SHA256 ([rfc6376](https://datatracker.ietf.org/doc/html/rfc6376) : DomainKeys Identified Mail (DKIM) Signatures) - Algorithm Ed25519-SHA256 : ([rfc8463](https://datatracker.ietf.org/doc/html/rfc8463) : A New Cryptographic Signature Method for DomainKeys Identified Mail (DKIM)) Pour SMTP - je check çà … Je lis « _liste d’algorithmes de chiffrement pour la négociation TLS a été mise à jour en janvier 2021._ » sur cette page : [Algorithmes de chiffrement pour les connexions TLS SMTP…](https://support.google.com/a/answer/9795993?hl=fr) TLS 1.3 - TLS\_AES\_128\_GCM\_SHA256 - TLS\_AES\_256\_GCM\_SHA384 - TLS\_CHACHA20\_POLY1305\_SHA256 ---
**Author:** ![anon36725218](https://www.debian-fr.org/letter_avatar_proxy/v4/letter/a/8e8cbc/32.png) [@anon36725218](https://www.debian-fr.org/u/anon36725218)\ **Post date:** [Novembre 9, 2023, 9:26 UTC](https://www.debian-fr.org/t/dane-dns-sec-tlsa-on-rr-smtp-domain-tld/89117/2 "2023-11-09T21:26:56Z")
J’ajoute mes deux posts du mois 🤣 😅 1. [Let’s Encrypt certicats - ca.pem (old certif) \<-\> commercial\_3.pem -…](https://forums.zimbra.org/viewtopic.php?p=311698#p311698) 2. [Authentication-Results: […] (amavis); dkim=neutral reason="invalid…](https://forums.zimbra.org/viewtopic.php?t=72379) Bonne soirée à vous mesdames, mesdamoiselles, messieurs. ---
**Author:** ![anon36725218](https://www.debian-fr.org/letter_avatar_proxy/v4/letter/a/8e8cbc/32.png) [@anon36725218](https://www.debian-fr.org/u/anon36725218)\ **Post date:** [Novembre 11, 2023, 11:52 UTC](https://www.debian-fr.org/t/dane-dns-sec-tlsa-on-rr-smtp-domain-tld/89117/3 "2023-11-11T11:52:01Z")
> [@anon36725218](#): > > çà pète, en passant 😊 > > CF : [https://stats.dnssec-tools.org/explore/?zw3b.eu](https://stats.dnssec-tools.org/explore/?zw3b.eu) C’est OK pour DNSSEC and SMTP DANE TLS adoption survey (updated daily) [RESOLU] → [https://stats.dnssec-tools.org/explore/](https://stats.dnssec-tools.org/explore/) [![Screenshot-2023-11-11-at-11-40-16-zw3b.eu-stats.dnssec-tools.org](https://www.debian-fr.org/uploads/default/original/2X/f/fbfda7448fa405f55524dbc01a4d1d41d0292962.png)](https://www.zw3b.fr/pub/screens/stats.dnssec-tools.org/Screenshot-2023-11-11-at-11-40-16-zw3b.eu-stats.dnssec-tools.org.png) `_25._tcp.smtp.domain.tld` → SMTP protocol `_465._tcp.smtp.domain.tld` → SMTPs protocol `_587._tcp.smtp.domain.tld` → SMTPs protocol - Submission (for web service je crois) Merci. Rien à voir mais je dis : Sinon, lorsque j’essaie de me connecter via openssl : Sur «  **smtp.zw3b.eu:25**  » (SMTP NON Sécurisé) → NON OK : ``` root@lab3w:~ # echo | openssl s_client -6 -connect smtp.zw3b.eu:25 CONNECTED(00000003) 139746243826880:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../ssl/record/ssl3_record.c:332: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 5 bytes and written 304 bytes Verification: OK --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated Early data was not sent Verify return code: 0 (ok) --- ``` Et sur " **smtp.zw3b.eu:587**" (SMTPs STARTTLS) ``` root@lab3w:~ # echo | openssl s_client -6 -connect smtp.zw3b.eu:587 CONNECTED(00000003) 139664478545088:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../ssl/record/ssl3_record.c:332: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 5 bytes and written 304 bytes Verification: OK --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated Early data was not sent Verify return code: 0 (ok) --- ``` Sinon je remarque que depuis un de mes serveur « lab3w » et depuis un autre « dc.w3a » - çà ne me ressort pas la même réponse. Sur «  **smtp.zw3b.eu:465**  » (SMTP Secure) → OK Depuis « lab3w » - Debian GNU/Linux 10 (buster) : ``` root@lab3w:~ # echo | openssl s_client -6 -connect smtp.zw3b.eu:465 CONNECTED(00000003) depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1 verify return:1 depth=1 C = US, O = Let's Encrypt, CN = R3 verify return:1 depth=0 CN = mail.zw3b.eu verify return:1 --- Certificate chain 0 s:CN = mail.zw3b.eu i:C = US, O = Let's Encrypt, CN = R3 1 s:CN = mail.zw3b.eu i:C = US, O = Let's Encrypt, CN = R3 2 s:C = US, O = Let's Encrypt, CN = R3 i:C = US, O = Internet Security Research Group, CN = ISRG Root X1 3 s:C = US, O = Internet Security Research Group, CN = ISRG Root X1 i:C = US, O = Internet Security Research Group, CN = ISRG Root X1 --- Server certificate -----BEGIN CERTIFICATE----- MIIGRjCCBS6gAwIBAgISBAO2RR2xXxEujKzQr5wV6Wf+MA0GCSqGSIb3DQEBCwUA [...] 2qAdtLT7EypMLxFAXAKB5uwr0mYf0mihwQs= -----END CERTIFICATE----- subject=CN = mail.zw3b.eu issuer=C = US, O = Let's Encrypt, CN = R3 --- No client certificate CA names sent Peer signing digest: SHA384 Peer signature type: ECDSA Server Temp Key: X25519, 253 bits --- SSL handshake has read 6335 bytes and written 384 bytes Verification: OK --- New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384 Server public key is 384 bit Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated Early data was not sent Verify return code: 0 (ok) --- DONE ``` Et depuis « dc.w3a » - Debian GNU/Linux 9 (stretch) : ``` root@dc.w3a:~ $ echo | openssl s_client -6 -connect smtp.zw3b.eu:465 CONNECTED(00000003) depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1 verify return:1 depth=1 C = US, O = Let's Encrypt, CN = R3 verify return:1 depth=0 CN = mail.zw3b.eu verify return:1 --- Certificate chain 0 s:/CN=mail.zw3b.eu i:/C=US/O=Let's Encrypt/CN=R3 1 s:/CN=mail.zw3b.eu i:/C=US/O=Let's Encrypt/CN=R3 2 s:/C=US/O=Let's Encrypt/CN=R3 i:/C=US/O=Internet Security Research Group/CN=ISRG Root X1 3 s:/C=US/O=Internet Security Research Group/CN=ISRG Root X1 i:/C=US/O=Internet Security Research Group/CN=ISRG Root X1 --- Server certificate -----BEGIN CERTIFICATE----- MIIGRjCCBS6gAwIBAgISBAO2RR2xXxEujKzQr5wV6Wf+MA0GCSqGSIb3DQEBCwUA [...] 2qAdtLT7EypMLxFAXAKB5uwr0mYf0mihwQs= -----END CERTIFICATE----- subject=/CN=mail.zw3b.eu issuer=/C=US/O=Let's Encrypt/CN=R3 --- No client certificate CA names sent Peer signing digest: SHA512 Server Temp Key: X25519, 253 bits --- SSL handshake has read 6413 bytes and written 269 bytes Verification: OK --- New, TLSv1.2, Cipher is ECDHE-ECDSA-AES256-GCM-SHA384 Server public key is 384 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-ECDSA-AES256-GCM-SHA384 Session-ID: 108778FCB7F6E6B5D2336D1658B53ED7171D3813C3FC268B7515C5E6948F824F Session-ID-ctx: Master-Key: 570C7A56776C764285DE27EF810D979945208D635D8AB7F1BD8C410A6ADDE46CC21ADCC2AB710BDF6AE6F887E5CF0FE9 PSK identity: None PSK identity hint: None SRP username: None TLS session ticket lifetime hint: 7200 (seconds) TLS session ticket: 0000 - ce 78 38 e9 4f 10 fe c8-d0 27 77 05 e8 b5 90 e8 .x8.O....'w..... 0010 - 4d f2 aa c2 84 06 3a 0c-a5 89 d9 61 f6 d0 87 f1 M.....:....a.... 0020 - 51 e8 13 41 bf 6f 9c 46-92 5d a5 20 c8 d0 70 d1 Q..A.o.F.]. ..p. 0030 - cb 38 ef 18 41 81 f2 97-a9 43 10 03 ac b3 42 4a .8..A....C....BJ 0040 - 04 c7 1a bd ba 1c 8f d4-ba 11 9b fc 72 37 41 88 ............r7A. 0050 - 1c 1a 15 d2 bd 59 a3 6e-c1 1e 6e 5f 4e 7d 95 b6 .....Y.n..n_N}.. 0060 - a1 13 cb d6 aa f3 59 80-09 16 9e 48 c8 62 55 74 ......Y....H.bUt 0070 - 5b 14 a7 13 4b 77 f9 e7-20 37 c7 68 a0 bf 54 ec [...Kw.. 7.h..T. 0080 - 5e 3b af 7e 09 68 d8 6e-c7 31 bf d9 53 fd a0 f7 ^;.~.h.n.1..S... 0090 - 04 69 30 07 6c 92 b0 fb-12 e5 46 9f 99 a8 d0 0b .i0.l.....F..... 00a0 - 11 b9 a8 ce e0 c0 91 32-ac 87 bb 13 aa b9 07 69 .......2.......i Start Time: 1699702342 Timeout : 7200 (sec) Verify return code: 0 (ok) Extended master secret: yes --- DONE ``` Sinon, tiens en plus j’ajoute çà : Ciphers SSL / TLS " **smtp.zw3b.eu:25**" : ``` root@lab3w:~ # nmap --script ssl-enum-ciphers -p 25 smtp.zw3b.eu -6 Starting Nmap 7.70 ( https://nmap.org ) at 2023-11-10 16:11 CET Nmap scan report for smtp.zw3b.eu (2607:5300:60:9389:17:4c1:0:1a) Host is up (0.00021s latency). Other addresses for smtp.zw3b.eu (not scanned): 158.69.126.137 rDNS record for 2607:5300:60:9389:17:4c1:0:1a: mail.zw3b.eu PORT STATE SERVICE 25/tcp open smtp MAC Address: CE:40:55:0E:58:A1 (Unknown) Nmap done: 1 IP address (1 host up) scanned in 1.39 seconds ``` Ciphers SSL / TLS " **smtp.zw3b.eu:465**" : ``` root@lab3w:~ # nmap --script ssl-enum-ciphers -p 465 smtp.zw3b.eu -6 Starting Nmap 7.70 ( https://nmap.org ) at 2023-11-10 16:11 CET Nmap scan report for smtp.zw3b.eu (2607:5300:60:9389:17:4c1:0:1a) Host is up (0.0030s latency). Other addresses for smtp.zw3b.eu (not scanned): 158.69.126.137 rDNS record for 2607:5300:60:9389:17:4c1:0:1a: mail.zw3b.eu PORT STATE SERVICE 465/tcp open smtps | ssl-enum-ciphers: | TLSv1.2: | ciphers: | TLS_DH_anon_WITH_AES_128_CBC_SHA - F | TLS_DH_anon_WITH_AES_128_CBC_SHA256 - F | TLS_DH_anon_WITH_AES_128_GCM_SHA256 - F | TLS_DH_anon_WITH_AES_256_CBC_SHA - F | TLS_DH_anon_WITH_AES_256_CBC_SHA256 - F | TLS_DH_anon_WITH_AES_256_GCM_SHA384 - F | TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (secp256r1) - A | TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (secp256r1) - A | TLS_ECDHE_ECDSA_WITH_AES_128_CCM (secp256r1) - A | TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 (secp256r1) - A | TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A | TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (secp256r1) - A | TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (secp256r1) - A | TLS_ECDHE_ECDSA_WITH_AES_256_CCM (secp256r1) - A | TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 (secp256r1) - A | TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A | TLS_ECDH_anon_WITH_AES_128_CBC_SHA - F | TLS_ECDH_anon_WITH_AES_256_CBC_SHA - F | compressors: | NULL | cipher preference: client | warnings: | Key exchange (secp256r1) of lower strength than certificate key |_ least strength: F MAC Address: CE:40:55:0E:58:A1 (Unknown) Nmap done: 1 IP address (1 host up) scanned in 14.67 seconds ``` Ciphers SSL / TLS " **smtp.zw3b.eu:587**" : ``` root@lab3w:~ # nmap --script ssl-enum-ciphers -p 587 smtp.zw3b.eu -6 Starting Nmap 7.70 ( https://nmap.org ) at 2023-11-10 16:12 CET Nmap scan report for smtp.zw3b.eu (2607:5300:60:9389:17:4c1:0:1a) Host is up (0.00030s latency). Other addresses for smtp.zw3b.eu (not scanned): 158.69.126.137 rDNS record for 2607:5300:60:9389:17:4c1:0:1a: mail.zw3b.eu PORT STATE SERVICE 587/tcp open submission | ssl-enum-ciphers: | TLSv1.2: | ciphers: | TLS_DH_anon_WITH_AES_128_CBC_SHA - F | TLS_DH_anon_WITH_AES_128_CBC_SHA256 - F | TLS_DH_anon_WITH_AES_128_GCM_SHA256 - F | TLS_DH_anon_WITH_AES_256_CBC_SHA - F | TLS_DH_anon_WITH_AES_256_CBC_SHA256 - F | TLS_DH_anon_WITH_AES_256_GCM_SHA384 - F | TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (secp256r1) - A | TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (secp256r1) - A | TLS_ECDHE_ECDSA_WITH_AES_128_CCM (secp256r1) - A | TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 (secp256r1) - A | TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A | TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (secp256r1) - A | TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (secp256r1) - A | TLS_ECDHE_ECDSA_WITH_AES_256_CCM (secp256r1) - A | TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 (secp256r1) - A | TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A | TLS_ECDH_anon_WITH_AES_128_CBC_SHA - F | TLS_ECDH_anon_WITH_AES_256_CBC_SHA - F | compressors: | NULL | cipher preference: client | warnings: | Key exchange (secp256r1) of lower strength than certificate key |_ least strength: F MAC Address: CE:40:55:0E:58:A1 (Unknown) Nmap done: 1 IP address (1 host up) scanned in 2.96 seconds ``` Si cela peut « aider » bien configurer ces algorithmes SSL/TLS → [Postfix Conf Parameters #smtp\_tls\_ciphers](https://www.postfix.org/postconf.5.html#smtp_tls_ciphers) J’ajoute les Tests SSL LABS ([captures d’écran](https://www.zw3b.fr/pub/screens/ssllabs.com/)) : - [SSL Server Test IPv4 : smtp.zw3b.eu (Powered by Qualys SSL Labs)](https://www.ssllabs.com/ssltest/analyze.html?d=smtp.zw3b.eu&s=158.69.126.137) - [SSL Server Test IPv6 : smtp.zw3b.eu (Powered by Qualys SSL Labs)](https://www.ssllabs.com/ssltest/analyze.html?d=smtp.zw3b.eu&s=2607%3A5300%3A60%3A9389%3A17%3A4c1%3A0%3A1a) En IPv4 çà pointe sur le wilcard - mais c’est une « erreur » de configuration, un oubli - il faut que j’ajoute smtp.zw3b.eu en port TCP 443 qui pointe « aussi » sur le serveur mail ce sera mieux 😉 [RESOLU] Bonne journée à vous. Salutations, Romain * * * Pour celles ou ceux que çà intéressent j’ai écris quelques [Zimbra : commandes liées à SSL/TLS](https://forums.zimbra.org/viewtopic.php?t=72381#p311723) postfix [..] sur le forum de Zimbra. ---
**Author:** ![anon36725218](https://www.debian-fr.org/letter_avatar_proxy/v4/letter/a/8e8cbc/32.png) [@anon36725218](https://www.debian-fr.org/u/anon36725218)\ **Post date:** [Novembre 11, 2023, 2:07 UTC](https://www.debian-fr.org/t/dane-dns-sec-tlsa-on-rr-smtp-domain-tld/89117/4 "2023-11-11T14:07:11Z")
C’est vraiment bizarre : Du serveur « lab3w » - Debian GNU/Linux 10 (buster) - Nmap 7.70 → ERREUR – j’ai un algo «  **secp384r1**  » ``` root@lab3w:~ # nmap --script ssl-enum-ciphers -p 465 smtp.zw3b.eu -6 Starting Nmap 7.70 ( https://nmap.org ) at 2023-11-11 15:03 CET Nmap scan report for smtp.zw3b.eu (2607:5300:60:9389:17:4c1:0:1a) Host is up (0.00023s latency). Other addresses for smtp.zw3b.eu (not scanned): 158.69.126.137 rDNS record for 2607:5300:60:9389:17:4c1:0:1a: mail.zw3b.eu PORT STATE SERVICE 465/tcp open smtps | ssl-enum-ciphers: | TLSv1.2: | ciphers: | TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (secp256r1) - A | TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (secp256r1) - A | TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A | TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (secp256r1) - A | TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (secp256r1) - A | TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A | compressors: | NULL | cipher preference: client | warnings: | Key exchange (secp256r1) of lower strength than certificate key |_ least strength: A MAC Address: CE:40:55:0E:58:A1 (Unknown) Nmap done: 1 IP address (1 host up) scanned in 6.65 seconds ``` Ce que je vois bien depuis le serveur « dc.w3a » - Debian GNU/Linux 9 (stretch) - Nmap 7.40 : ``` root@dc.w3a:~ $ nmap --script ssl-enum-ciphers -p 465 smtp.zw3b.eu -6 Starting Nmap 7.40 ( https://nmap.org ) at 2023-11-11 15:03 CET Nmap scan report for smtp.zw3b.eu (2607:5300:60:9389:17:4c1:0:1a) Host is up (0.10s latency). Other addresses for smtp.zw3b.eu (not scanned): 158.69.126.137 rDNS record for 2607:5300:60:9389:17:4c1:0:1a: mail.zw3b.eu PORT STATE SERVICE 465/tcp open smtps | ssl-enum-ciphers: | TLSv1.2: | ciphers: | TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (secp384r1) - A | TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (secp384r1) - A | TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (secp384r1) - A | TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (secp384r1) - A | TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (secp384r1) - A | TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (secp384r1) - A | compressors: | NULL | cipher preference: client |_ least strength: A Nmap done: 1 IP address (1 host up) scanned in 9.70 seconds ``` ASN1 OID: **secp384r1** National Institute of Standards and Technology CURVE: **P-384** ``` root@lab3w:~ # echo | openssl s_client -6 -connect smtp.zw3b.eu:465 | openssl x509 -text -noout depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1 verify return:1 depth=1 C = US, O = Let's Encrypt, CN = R3 verify return:1 depth=0 CN = mail.zw3b.eu verify return:1 DONE Certificate: Data: Version: 3 (0x2) Serial Number: 04:03:b6:45:1d:b1:5f:11:2e:8c:ac:d0:af:9c:15:e9:67:fe Signature Algorithm: sha256WithRSAEncryption Issuer: C = US, O = Let's Encrypt, CN = R3 Validity Not Before: Nov 7 15:26:37 2023 GMT Not After : Feb 5 15:26:36 2024 GMT Subject: CN = mail.zw3b.eu Subject Public Key Info: Public Key Algorithm: id-ecPublicKey Public-Key: (384 bit) pub: 04:12:c1:14:2c:d2:45:d6:92:82:10:b5:27:58:3d: d2:10:80:40:2d:a4:07:b5:6e:2f:9c:91:72:cb:cd: a3:1e:09:ec:75:08:f5:41:37:0c:9e:0d:a6:fe:89: e5:41:3f:77:48:54:a6:35:15:4f:95:b9:82:c9:42: 8e:f6:ff:cd:f4:3a:be:77:3f:af:d4:04:40:a0:33: cf:65:15:52:30:e4:ea:e3:0a:72:9b:6a:41:1a:54: 9a:bd:52:ee:6b:d4:ec ASN1 OID: secp384r1 NIST CURVE: P-384 X509v3 extensions: X509v3 Key Usage: critical Digital Signature X509v3 Extended Key Usage: TLS Web Server Authentication, TLS Web Client Authentication X509v3 Basic Constraints: critical CA:FALSE X509v3 Subject Key Identifier: FF:D3:55:B5:EB:0C:84:A0:8B:A7:3C:04:38:73:8F:02:9D:C1:9E:8D X509v3 Authority Key Identifier: keyid:14:2E:B3:17:B7:58:56:CB:AE:50:09:40:E6:1F:AF:9D:8B:14:C2:C6 Authority Information Access: OCSP - URI:http://r3.o.lencr.org CA Issuers - URI:http://r3.i.lencr.org/ X509v3 Subject Alternative Name: DNS:imap.zw3b.blog, DNS:imap.zw3b.com, DNS:imap.zw3b.eu, DNS:imap.zw3b.fr, DNS:imap.zw3b.net, DNS:imap.zw3b.site, DNS:imap.zw3b.tv, DNS:mail.zw3b.blog, DNS:mail.zw3b.com, DNS:mail.zw3b.eu, DNS:mail.zw3b.fr, DNS:mail.zw3b.net, DNS:mail.zw3b.site, DNS:mail.zw3b.tv, DNS:pop.zw3b.blog, DNS:pop.zw3b.com, DNS:pop.zw3b.eu, DNS:pop.zw3b.fr, DNS:pop.zw3b.net, DNS:pop.zw3b.site, DNS:pop.zw3b.tv, DNS:smtp.zw3b.blog, DNS:smtp.zw3b.com, DNS:smtp.zw3b.eu, DNS:smtp.zw3b.fr, DNS:smtp.zw3b.net, DNS:smtp.zw3b.site, DNS:smtp.zw3b.tv, DNS:webmail.zw3b.blog, DNS:webmail.zw3b.com, DNS:webmail.zw3b.eu, DNS:webmail.zw3b.fr, DNS:webmail.zw3b.net, DNS:webmail.zw3b.site, DNS:webmail.zw3b.tv X509v3 Certificate Policies: Policy: 2.23.140.1.2.1 CT Precertificate SCTs: Signed Certificate Timestamp: Version : v1 (0x0) Log ID : 3B:53:77:75:3E:2D:B9:80:4E:8B:30:5B:06:FE:40:3B: 67:D8:4F:C3:F4:C7:BD:00:0D:2D:72:6F:E1:FA:D4:17 Timestamp : Nov 7 16:26:38.263 2023 GMT Extensions: none Signature : ecdsa-with-SHA256 30:45:02:21:00:94:67:2C:65:F1:F5:7F:18:4B:D8:A5: 78:67:B1:D3:83:8B:E3:0F:4E:0B:86:02:DE:B8:42:95: 55:6E:1D:70:0F:02:20:37:25:80:CE:A2:82:CD:BF:C8: DC:4B:FB:75:BA:B7:89:A6:7C:2D:36:B5:8B:C9:7F:45: 30:B0:6C:F6:6C:2A:52 Signed Certificate Timestamp: Version : v1 (0x0) Log ID : EE:CD:D0:64:D5:DB:1A:CE:C5:5C:B7:9D:B4:CD:13:A2: 32:87:46:7C:BC:EC:DE:C3:51:48:59:46:71:1F:B5:9B Timestamp : Nov 7 16:26:38.323 2023 GMT Extensions: none Signature : ecdsa-with-SHA256 30:46:02:21:00:CD:35:50:C5:E3:D5:DF:4C:D5:C0:A6: D0:B8:34:2F:74:32:28:7C:24:49:E8:A0:8E:4B:97:02: C0:10:47:EB:BC:02:21:00:8A:28:D3:A3:34:CE:25:B6: 54:34:E7:28:AF:BC:54:86:7A:B9:F8:53:20:BE:03:68: 55:8B:56:55:84:F8:D7:38 Signature Algorithm: sha256WithRSAEncryption 33:5f:6c:4b:6e:b5:de:5c:bc:5a:62:f4:93:7f:cc:c7:aa:4e: 41:f1:b9:d6:48:58:ec:d9:8f:d8:66:26:f1:d0:5a:9e:3a:0c: 35:bf:9c:9a:74:53:fe:b1:1a:32:a8:65:15:74:04:49:da:68: 1e:db:ff:84:3e:58:14:f0:71:8e:25:1d:45:1e:28:3f:ea:17: 16:4f:0b:51:04:c0:5d:c4:94:72:73:10:5f:4c:a8:4a:1a:a6: 84:31:fa:b1:3b:f3:69:50:79:74:4b:0d:ca:6a:11:82:1f:bf: 26:be:d7:35:3d:f1:ae:67:e8:c6:a5:56:21:36:7c:07:46:96: 8e:83:b5:9d:27:16:ae:68:2e:48:94:57:f3:b0:ff:fe:f6:81: e6:c7:91:3c:36:5c:69:ac:02:0d:00:4b:e0:3c:9b:bf:2f:41: 85:a8:c1:26:2c:6a:f5:fd:d3:06:02:b7:89:84:76:65:a9:22: 88:67:1a:98:ee:8b:25:74:54:c5:4a:15:45:0f:7d:32:9f:d8: 10:de:42:44:25:3d:65:1d:9d:98:f5:5b:b4:4e:08:44:ba:4c: 1e:02:52:ff:c8:55:ba:f5:0c:8e:8c:d4:4a:e3:da:a0:1d:b4: b4:fb:13:2a:4c:2f:11:40:5c:02:81:e6:ec:2b:d2:66:1f:d2: 68:a1:c1:0b ``` J’ajoute [TLS1.3 - OpenSSLWiki](https://wiki.openssl.org/index.php/TLS1.3) : ``` root@mail:~ # /usr/bin/openssl ciphers -s -v ECDHE | grep "TLSv1.3" | column -t TLS_AES_256_GCM_SHA384 TLSv1.3 Kx=any Au=any Enc=AESGCM(256) Mac=AEAD TLS_CHACHA20_POLY1305_SHA256 TLSv1.3 Kx=any Au=any Enc=CHACHA20/POLY1305(256) Mac=AEAD TLS_AES_128_GCM_SHA256 TLSv1.3 Kx=any Au=any Enc=AESGCM(128) Mac=AEAD ``` TLS1.2 ``` root@mail:~ # /usr/bin/openssl ciphers -s -v ECDHE | grep "TLSv1.2" | column -t ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(256) Mac=AEAD ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD ECDHE-ECDSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=ECDSA Enc=CHACHA20/POLY1305(256) Mac=AEAD ECDHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=RSA Enc=CHACHA20/POLY1305(256) Mac=AEAD ECDHE-ECDSA-AES256-CCM8 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESCCM8(256) Mac=AEAD ECDHE-ECDSA-AES256-CCM TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESCCM(256) Mac=AEAD ECDHE-ECDSA-ARIA256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=ARIAGCM(256) Mac=AEAD ECDHE-ARIA256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=ARIAGCM(256) Mac=AEAD ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(128) Mac=AEAD ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(128) Mac=AEAD ECDHE-ECDSA-AES128-CCM8 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESCCM8(128) Mac=AEAD ECDHE-ECDSA-AES128-CCM TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESCCM(128) Mac=AEAD ECDHE-ECDSA-ARIA128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=ARIAGCM(128) Mac=AEAD ECDHE-ARIA128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=ARIAGCM(128) Mac=AEAD ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA384 ECDHE-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA384 ECDHE-ECDSA-CAMELLIA256-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=Camellia(256) Mac=SHA384 ECDHE-RSA-CAMELLIA256-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=Camellia(256) Mac=SHA384 ECDHE-ECDSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA256 ECDHE-RSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA256 ECDHE-ECDSA-CAMELLIA128-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=Camellia(128) Mac=SHA256 ECDHE-RSA-CAMELLIA128-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=Camellia(128) Mac=SHA256 ``` * * * ---
**Author:** ![anon36725218](https://www.debian-fr.org/letter_avatar_proxy/v4/letter/a/8e8cbc/32.png) [@anon36725218](https://www.debian-fr.org/u/anon36725218)\ **Post date:** [Novembre 12, 2023, 4:51 UTC](https://www.debian-fr.org/t/dane-dns-sec-tlsa-on-rr-smtp-domain-tld/89117/5 "2023-11-12T16:51:58Z")
En parlant de certificats TLS, de sécurité et compagnies. J’ajouterai une bêtise sur la configuration (essentielle) que tout le monde connaît : Exemples de captures d’écran de configuration de Thunderbird : Note de Moi-même le lendemain, le 20231113 : j’ai des erreurs, çà ne rentre plus en configurant le port 993 et çà ne part en port 587. - SMTP on port 587 (pour le cryptage de la transaction entre votre ordinateur/smartphone et le serveur d’envoi - afin que personne au milieu ne puisse lire votre mot de passe transmis) ![configuration-smtp.zw3b.eu](https://www.debian-fr.org/uploads/default/original/2X/4/435b37f082a7837a78c5b115d5a0e819ffa209bf.png) - imap on my port 993 (pour le cryptage de la transaction entre votre ordinateur/smartphone et le serveur recevant vos e-mails - afin qu’aucune personne intermédiaire ne puisse lire votre mot de passe transmis) ![configuration-imap.zw3b.eu](https://www.debian-fr.org/uploads/default/original/2X/c/ca494d453faef5b36bd7fb45c0feef42888dd39f.png) Commandes NMAP vérifiant les suites de chiffrement : ``` nmap --script ssl-enum-ciphers -p 143 imap.zw3b.eu -6 nmap --script ssl-enum-ciphers -p 993 imap.zw3b.eu -6 nmap --script ssl-enum-ciphers -p 25 smtp.zw3b.eu -6 nmap --script ssl-enum-ciphers -p 465 smtp.zw3b.eu -6 nmap --script ssl-enum-ciphers -p 587 smtp.zw3b.eu -6 ``` J’ajoute ce lien web : [Test SMTP with telnet or openssl](https://www.stevenrombauts.be/2018/12/test-smtp-with-telnet-or-openssl/) * * * NdMoi-même 20231113 : J’ai un truc cooL à lire : [Postfix Configuration Parameters : #smtpd\_tls\_eecdh\_grade](https://www.postfix.org/postconf.5.html#smtpd_tls_eecdh_grade) cet article → [TLS Forward Secrecy in Postfix](https://www.postfix.org/FORWARD_SECRECY_README.html#quick-start) 😉