dovecot - Dec 2014 - disabling certain ciphers

On 12/2/2014 10:05 AM, Will Yardley wrote:
> I had some problems the first few times I restarted with ssl-params
> seeming to hang, but it finally works.
That would have been dovecot generating the 4096-bit DH parameters.  It 
can take a bit, but Dovecot is quite fast at it.  If Dovecot supported 
it, you could use OpenSSL to generate tested-safe DH parameters and 
supply them by file the same way you do for Postfix, nginx, etc.

On Tue, Dec 02, 2014 at 10:12:22AM -0800, Darren Pilgrim
wrote:
> On 12/2/2014 10:05 AM, Will Yardley wrote:
> > I had some problems the first few times I restarted with ssl-params
> > seeming to hang, but it finally works.
> 
> That would have been dovecot generating the 4096-bit DH parameters.  It 
> can take a bit, but Dovecot is quite fast at it.  If Dovecot supported 
> it, you could use OpenSSL to generate tested-safe DH parameters and 
> supply them by file the same way you do for Postfix, nginx, etc.
In this case, it was consuming a lot of CPU for 5+ minutes, and the
.dat.tmp file hadn't been updated since the process started, so I'm not
sure if something went wrong. strace on the ssl-params process itself
(without following child procs, anyway) didn't seem to show anything
happening. This happened for a couple of restarts.

I enabled verbose ssl logging, restarted, and it seemed to work, then
disabled verbose logging again, and it still works.

w

On 12/2/2014 10:26 AM, Will Yardley wrote:
> In this case, it was consuming a lot of CPU for 5+ minutes, and the
> .dat.tmp file hadn't been updated since the process started, so I'm
not
> sure if something went wrong.
Yes, large DH parameters take time to generate, hence turning off 
regeneration.  5 minutes is pretty reasonable.