Spam Filter ISP Forums : Disable TLS1_0 and SSLv3 https://www.logsat.com/spamfilter/forums/ Tue, 19 May 2026 06:42:09 +0000 Thu, 07 May 2015 06:57:33 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=7111 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[Disable TLS1_0 and SSLv3 : Here&#039;s the log:05.05.15 14:00:22:039...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7111&PID=14735&title=disable-tls1-0-and-sslv3#14735 Author: ois
Subject: 7111
Posted: 07 May 2015 at 6:57am

Here's the log:
05.05.15 14:00:22:039 -- (168694128) Detected TCP Connection: 173.0.84.227 on port: 25
05.05.15 14:00:22:039 -- (168694128) Connection from: 173.0.84.227  -  Originating country : United States
05.05.15 14:00:22:415 -- (168694128) Received STARTTLS command
05.05.15 14:00:22:555 -- (168694128) Disconnect
05.05.15 14:00:22:571 -- (168694128) IdSMTPServerException non-critical error: Error accepting connection with SSL. -- error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol

mx2.slc.paypal.com [173.0.84.227]
This mails-server sends transaction mails to merchants.
It is very impotant to our customers.


]]> Thu, 07 May 2015 06:57:33 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7111&PID=14735&title=disable-tls1-0-and-sslv3#14735 <![CDATA[Disable TLS1_0 and SSLv3 : We&#039;re not aware of any issues...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7111&PID=14733&title=disable-tls1-0-and-sslv3#14733 Author: LogSat
Subject: 7111
Posted: 06 May 2015 at 11:10pm

We're not aware of any issues specific with PayPal - we'll look into it.]]> Wed, 06 May 2015 23:10:21 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7111&PID=14733&title=disable-tls1-0-and-sslv3#14733 <![CDATA[Disable TLS1_0 and SSLv3 : There is the same issue with emails...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7111&PID=14731&title=disable-tls1-0-and-sslv3#14731 Author: ois
Subject: 7111
Posted: 06 May 2015 at 5:26am

There is the same issue with emails from paypal.com with"EnableTLSSupport=1"
Are you shure this ok?
Meanwhile i configured "EnableTLSSupport=0"
But this is'nt the solution i have do have here.

Regards, Fritz

]]> Wed, 06 May 2015 05:26:10 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7111&PID=14731&title=disable-tls1-0-and-sslv3#14731 <![CDATA[Disable TLS1_0 and SSLv3 : Sorry, that cannot be done. The...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7111&PID=14730&title=disable-tls1-0-and-sslv3#14730 Author: LogSat
Subject: 7111
Posted: 05 May 2015 at 2:18pm

Sorry, that cannot be done. The enabled protocols/ciphers are determined upon listener startup, so they can't be customized per TCP connection. Well-behaved SMTP servers should file over to non-SSL/non-TLS connections if they can't make an encrypted connection, unless they were configured for security reasons to require an encrypted connection. However if they were configured like that for security reasons, then they would not be using insecure/vulnerable protocols...

If the failover to non-SSL/TLS is not working, besides disabling TLS support completely, you could try setting up another SpamFilter instance listening on a different IP, making that your secondary/tertiary MX record, and configuring that one with "EnableTLSSupport=0" to disable TLS support. The server that is using the older SSL protocols should then fail with the primary MX and connect to this secondary MX (as long as they respect the RFC and do try the secondary MX record).

In regards to the SpamFilter license, you can run as many instances of SpamFilter as you want on the same server using just one license. We require separate licenses only if you install SpamFilter on separate servers.
]]> Tue, 05 May 2015 14:18:40 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7111&PID=14730&title=disable-tls1-0-and-sslv3#14730 <![CDATA[Disable TLS1_0 and SSLv3 : Ok, I understand, but is there...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7111&PID=14729&title=disable-tls1-0-and-sslv3#14729 Author: ois
Subject: 7111
Posted: 05 May 2015 at 12:47pm

Ok,  I understand, but is there a possibility to switch to a unsafe mode to accept this connection?
Best within a WhiteList?
The Problem is, a very important custumer didn't receive mails, after I installed 4.87.0.133 and
EnableTLSSupport=1


]]> Tue, 05 May 2015 12:47:25 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7111&PID=14729&title=disable-tls1-0-and-sslv3#14729 <![CDATA[Disable TLS1_0 and SSLv3 : ]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7111&PID=14728&title=disable-tls1-0-and-sslv3#14728 Author: ois
Subject: 7111
Posted: 05 May 2015 at 12:41pm

]]> Tue, 05 May 2015 12:41:46 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7111&PID=14728&title=disable-tls1-0-and-sslv3#14728 <![CDATA[Disable TLS1_0 and SSLv3 : These errors are logged when a...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7111&PID=14727&title=disable-tls1-0-and-sslv3#14727 Author: LogSat
Subject: 7111
Posted: 05 May 2015 at 12:26pm

These errors are logged when a client is attempting to connect using a cipher not supported/allowed by SpamFilter. If they for example try to connect using the older/unsafe SSLv2, this non-critical error will be logged.]]> Tue, 05 May 2015 12:26:16 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7111&PID=14727&title=disable-tls1-0-and-sslv3#14727 <![CDATA[Disable TLS1_0 and SSLv3 : What is this?05.05.15 16:02:44:507...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7111&PID=14726&title=disable-tls1-0-and-sslv3#14726 Author: ois
Subject: 7111
Posted: 05 May 2015 at 10:33am

What is this?

05.05.15 16:02:44:507 -- (255717888) Connection from: 212.62.77.230  -  Originating country : Germany
05.05.15 16:02:44:554 -- (255717888) Received STARTTLS command
05.05.15 16:02:44:570 -- (255717888) Disconnect
05.05.15 16:02:44:570 -- (255717888) IdSMTPServerException non-critical error: Error accepting connection with SSL. -- error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol

]]> Tue, 05 May 2015 10:33:55 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7111&PID=14726&title=disable-tls1-0-and-sslv3#14726 <![CDATA[Disable TLS1_0 and SSLv3 : The issue has been fixed and the...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7111&PID=14722&title=disable-tls1-0-and-sslv3#14722 Author: LogSat
Subject: 7111
Posted: 23 April 2015 at 10:46pm

The issue has been fixed and the patch will be publicly released within the next 48 hours while we complete Quality Assurance for it. Should you need it sooner we'll be glad to provide it to you.

Thanks again for reporting this.
]]> Thu, 23 Apr 2015 22:46:33 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7111&PID=14722&title=disable-tls1-0-and-sslv3#14722 <![CDATA[Disable TLS1_0 and SSLv3 : ois, I apologize, you are absolutely...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7111&PID=14720&title=disable-tls1-0-and-sslv3#14720 Author: LogSat
Subject: 7111
Posted: 23 April 2015 at 2:50pm

ois, I apologize, you are absolutely right - we duplicated the issue. There has been a regression error starting from a previous version that caused that setting to not being read from the .ini file anymore. We will have a fix within the next few hours.]]> Thu, 23 Apr 2015 14:50:57 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=7111&PID=14720&title=disable-tls1-0-and-sslv3#14720