diff options
Diffstat (limited to '.config/dovecot/conf.d/10-ssl.conf')
| -rwxr-xr-x | .config/dovecot/conf.d/10-ssl.conf | 75 |
1 files changed, 75 insertions, 0 deletions
diff --git a/.config/dovecot/conf.d/10-ssl.conf b/.config/dovecot/conf.d/10-ssl.conf new file mode 100755 index 0000000..d9aed2f --- /dev/null +++ b/.config/dovecot/conf.d/10-ssl.conf @@ -0,0 +1,75 @@ +## +## SSL settings +## + +# SSL/TLS support: yes, no, required. <doc/wiki/SSL.txt> +ssl = no + +# PEM encoded X.509 SSL/TLS certificate and private key. They're opened before +# dropping root privileges, so keep the key file unreadable by anyone but +# root. Included doc/mkcert.sh can be used to easily generate self-signed +# certificate, just make sure to update the domains in dovecot-openssl.cnf +# ssl_cert = </etc/dovecot/private/dovecot.pem +# ssl_key = </etc/dovecot/private/dovecot.key + +# If key file is password protected, give the password here. Alternatively +# give it when starting dovecot with -p parameter. Since this file is often +# world-readable, you may want to place this setting instead to a different +# root owned 0600 file by using ssl_key_password = <path. +#ssl_key_password = + +# PEM encoded trusted certificate authority. Set this only if you intend to use +# ssl_verify_client_cert=yes. The file should contain the CA certificate(s) +# followed by the matching CRL(s). (e.g. ssl_ca = </etc/ssl/certs/ca.pem) +#ssl_ca = + +# Require that CRL check succeeds for client certificates. +#ssl_require_crl = yes + +# Directory and/or file for trusted SSL CA certificates. These are used only +# when Dovecot needs to act as an SSL client (e.g. imapc backend or +# submission service). The directory is usually /etc/ssl/certs in +# Debian-based systems and the file is /etc/pki/tls/cert.pem in +# RedHat-based systems. +# ssl_client_ca_dir = /etc/ssl/certs +#ssl_client_ca_file = + +# Request client to send a certificate. If you also want to require it, set +# auth_ssl_require_client_cert=yes in auth section. +#ssl_verify_client_cert = no + +# Which field from certificate to use for username. commonName and +# x500UniqueIdentifier are the usual choices. You'll also need to set +# auth_ssl_username_from_cert=yes. +#ssl_cert_username_field = commonName + +# SSL DH parameters +# Generate new params with `openssl dhparam -out /etc/dovecot/dh.pem 4096` +# Or migrate from old ssl-parameters.dat file with the command dovecot +# gives on startup when ssl_dh is unset. +# ssl_dh = </usr/share/dovecot/dh.pem + +# Minimum SSL protocol version to use. Potentially recognized values are SSLv3, +# TLSv1, TLSv1.1, and TLSv1.2, depending on the OpenSSL version used. +#ssl_min_protocol = TLSv1 + +# SSL ciphers to use, the default is: +#ssl_cipher_list = ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH +# To disable non-EC DH, use: +#ssl_cipher_list = ALL:!DH:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH + +# Colon separated list of elliptic curves to use. Empty value (the default) +# means use the defaults from the SSL library. P-521:P-384:P-256 would be an +# example of a valid value. +#ssl_curve_list = + +# Prefer the server's order of ciphers over client's. +#ssl_prefer_server_ciphers = no + +# SSL crypto device to use, for valid values run "openssl engine" +#ssl_crypto_device = + +# SSL extra options. Currently supported options are: +# compression - Enable compression. +# no_ticket - Disable SSL session tickets. +#ssl_options = |