question: allow tlsv1.0 connections? #4481

Preloading · 2025-05-21T02:31:44Z

Preloading
May 21, 2025

Hi there!

I'm trying to get my DMS working with an old iPhone, but since apple forgot to update the mail app's SSL stack till 2017, i'm stuck with TLSv1.

I have set the TLS_LEVEL to intermediate in the config

yet, it still disallows TLSv1

$ openssl s_client -connect mailserver.example.org:993 -tls1
CONNECTED(00000003)
4067A9B761750000:error:0A000126:SSL routines:ssl3_read_n:unexpected eof while reading:../ssl/record/rec_layer_s3.c:322:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 145 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1747793246
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
---

DMS logs

2025-05-20T20:09:36.749542-06:00 mailserver dovecot: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:0A0000C1:SSL routines::no shared cipher (disconnected before auth was ready, waited 0 secs): user=<>, rip=blankedforprivacy, lip=192.168.96.3, TLS handshaking: SSL_accept() failed: error:0A0000C1:SSL routines::no shared cipher, session=<qadc25s1jN4yQcnc>

I also tried to add

ssl_min_protocol = TLSv1

to the dms/config/dovecot.cf, yet it still refuses tlsv1.0 connections after a compose down & compose up.

Any idea what could be wrong?

Answered by polarathene

May 22, 2025

Compatibility broke from DMS v14 release (the upgrade to Debian 12 + OpenSSL 3).

I have investigated and updated the linked comment with a working workaround solution that I've verified. You should be able to use that.

NOTE: If you want to use the configs feature as demonstrated in the compose.yaml instead of separate files in a volume mount, you'll need a version of Docker Compose that is new enough to support it (minimum v2.23.1, released in Nov 2023).

View full answer

polarathene · 2025-05-21T06:20:11Z

polarathene
May 21, 2025
Maintainer

but since apple forgot to update the mail app's SSL stack till 2017, i'm stuck with TLSv1.

Is ThunderBird available? Or using a web mail client that you can self-host (or use a private service like Gmail) to connect to DMS?

I have set the TLS_LEVEL to intermediate in the config

The description of the ENV in that file is outdated, as is the equivalent in our docs, I'll update that.

Support for TLS below version 1.2 was dropped in DMS v12.0 (April 2023).

The related logic is here (which calls this function to modify Dovecot + Postfix):

docker-mailserver/target/scripts/helpers/ssl.sh

Lines 145 to 150 in a0e0013

    
           ( "intermediate" ) 
        
             local TLS_INTERMEDIATE_SUITE='ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256' 
        
             local TLS_INTERMEDIATE_IGNORE='!SSLv2,!SSLv3,!TLSv1,!TLSv1.1' 
        
             local TLS_INTERMEDIATE_MIN='TLSv1.2' 
        
             _apply_tls_level "${TLS_INTERMEDIATE_SUITE}" "${TLS_INTERMEDIATE_IGNORE}" "${TLS_INTERMEDIATE_MIN}"

There is a [related tracking issue] about the few users that still request support for older TLS due to legacy devices, although it's more focused on dropping legacy support completely at a future point 😅

I also tried to add
ssl_min_protocol = TLSv1

In addition to the changes DMS makes, Debian 12 carries a change with OpenSSL config that prevented using an old version of TLS that you want, so another change is also necessary.

Thankfully for you, I've documented a workaround that you can use our user-patches.sh file support to configure :)

3 replies

Preloading May 22, 2025
Author

Is ThunderBird available?

Unfortunetly, no iOS version of Thunderbird has released,

Or using a web mail client that you can self-host

The web browser on this device is... outdated, and can barely render any modern websites, I find it unlikely that any web client would function.

Thankfully for you, I've documented a workaround that you can use our user-patches.sh file support to configure :)

After trying these scripts, the same problem occurs (modifying them to run the function, and such), it rejects TLSv1.0. The first one was also complaning about MinProtocol & some other thing not in the config, so I changed it to add it to the end, yet it still fails to run.

polarathene May 22, 2025
Maintainer

Compatibility broke from DMS v14 release (the upgrade to Debian 12 + OpenSSL 3).

I have investigated and updated the linked comment with a working workaround solution that I've verified. You should be able to use that.

NOTE: If you want to use the configs feature as demonstrated in the compose.yaml instead of separate files in a volume mount, you'll need a version of Docker Compose that is new enough to support it (minimum v2.23.1, released in Nov 2023).

Answer selected by Preloading

Preloading May 22, 2025
Author

Thank you so much! This seems to have worked. (I used seperate volume mounts, since debian)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Docker Mailserver

question: allow tlsv1.0 connections? #4481

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 1 comment 3 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Docker Mailserver

question: allow tlsv1.0 connections? #4481

Uh oh!

Uh oh!

Preloading May 21, 2025

Replies: 1 comment · 3 replies

Uh oh!

polarathene May 21, 2025 Maintainer

Uh oh!

Uh oh!

Preloading May 22, 2025 Author

Uh oh!

polarathene May 22, 2025 Maintainer

Uh oh!

Preloading May 22, 2025 Author

Preloading
May 21, 2025

Replies: 1 comment 3 replies

polarathene
May 21, 2025
Maintainer

Preloading May 22, 2025
Author

polarathene May 22, 2025
Maintainer

Preloading May 22, 2025
Author