for anyone trying to resolve any warnings about cipher suites, cipher suite order,
parameters for key exchange, or hash function for key exchange when checking their mailservers using internet.nl
these settings resolve all those:
create /etc/postfix/tls_config.conf, contents:
postfix = postfix_settings
[postfix_settings]
ssl_conf = postfix_ssl_settings
[postfix_ssl_settings]
system_default = postfix_tls_defaults
[postfix_tls_defaults]
SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:RSA+SHA256:RSA+SHA384:RSA+SHA512
Groups = X25519:P-256:P-384
What they do: These configuration lines set up the inheritance map. When Postfix tells OpenSSL it is initializing an SSL/TLS context, OpenSSL looks for a profile matching the application name postfix. These mappings redirect that check down into your custom section ([postfix_tls_defaults]), ensuring your strict rules only apply to the mail server and don't break other OS services globally.
SignatureAlgorithms = ...
• What it does: This controls the digital signatures used to verify the cryptographic keys during a TLS 1.2 or TLS 1.3 handshake.
• The Security Impact: By explicitly listing only SHA256, SHA384, and SHA512 algorithm types, you are strictly blocking SHA-1 and MD5 from being used to sign key exchanges. If a scanning tool or an old server attempts to negotiate a handshake using an insecure SHA-1 signature, OpenSSL will instantly drop the connection.
Groups = X25519😛-256😛-384
• What it does: This configures the allowed Diffie-Hellman key exchange groups/curves, ordered strictly from highest preference to lowest.
• The Security Impact: This is the directive that explicitly eliminates the DH-4096 warning. By naming only specific Elliptic Curves (X25519, P-256, P-384),
you are telling the OpenSSL engine to completely remove finite-field Diffie-Hellman groups from your mail server's handshake capabilities.
Because standard Diffie-Hellman is disabled entirely, your server will never fall back to presenting a 4096-bit prime parameter, which perfectly satisfies
the NCSC guidelines.
create /etc/dovecot/conf.d/99-hardened-ssl.conf
contents:
# Custom security parameters - Safe from Enhance Panel updates
ssl_dh =
ssl_prefer_server_ciphers = yes
ssl_dh =
• What it does: This controls whether Dovecot exposes fallback file parameters for old-school finite-field Diffie-Hellman (DHE) key exchanges.
• The Security Impact: By leaving this setting completely blank (an empty string), you tell Dovecot to completely clear out its legacy fallback prime tables. This effectively disables standard Diffie-Hellman exchanges on your IMAP/POP3 ports and forces Dovecot to securely rely on modern, built-in elliptic curves. This is the parameter that completely eliminates the DH-4096 phase-out warning on port 993 and port 995.
ssl_prefer_server_ciphers = yes
• What it does: This activates cipher preemption. It tells the mail server that when a mail client (like Thunderbird, Outlook, or an Apple Mail app) connects, the server's list of preferred secure ciphers must be chosen over the client's.
• The Security Impact: It blocks a client from picking a weaker, less secure cipher suite that it might prefer. Because you enforce this on the server side, your strong cryptographic choices are absolute and cannot be negotiated down by an external device.
changes to /etc/postfix/main.cf
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_exclude_ciphers = RC4, aNULL
smtp_tls_exclude_ciphers = RC4, aNULL
smtpd_tls_mandatory_ciphers = medium
tls_medium_cipherlist = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305
tls_preempt_cipherlist = yes
### these entries might not exist in your file.. if they do, just comment them out / delete them #####
#smtpd_tls_dh1024_param_file = /etc/ssl/private/ffdhe4096.pem
#smtpd_tls_dh512_param_file = /etc/ssl/private/ffdhe4096.pem
smtpd_tls_eecdh_grade = ultra
tls_ffdhe_auto_groups =
smtpd_tls_dh1024_param_file =
#### these are just to remove some noise from the postfix.log file ####
mua_client_restrictions =
mua_helo_restrictions =
mua_sender_restrictions =
tls_config_file = /etc/postfix/tls_config.conf
tls_config_name = postfix
the tls protocol / cipher settings at the top should be self-explanatory.
#smtpd_tls_dh1024_param_file = /etc/ssl/private/ffdhe4096.pem
#smtpd_tls_dh512_param_file = /etc/ssl/private/ffdhe4096.pem
smtpd_tls_eecdh_grade = ultra
tls_ffdhe_auto_groups =
smtpd_tls_dh1024_param_file =
• What they do: This is the core engine work that completely clears the Parameters for key exchange warning. Commenting out the 4096-bit .pem files stops the server from manually advertising heavy finite-field primes.
• The Security Impact: Setting smtpd_tls_eecdh_grade = ultra forces Postfix to default entirely to top-tier elliptic curves. Leaving tls_ffdhe_auto_groups and smtpd_tls_dh1024_param_file completely blank strips away all automated backup finite-field Diffie-Hellman groups. This leaves Postfix with zero access to traditional Diffie-Hellman primes, successfully clearing the NCSC phase-out warning.
mua_client_restrictions =
mua_helo_restrictions =
mua_sender_restrictions =
What they do: These definitions are completely cosmetic placeholders. Enhance Panel templates a custom master.cf layout that references these three variables for authenticated user submissions. Because they weren't defined anywhere in the original main.cf, Postfix threw warnings every time the service initialized.
Leaving them blank satisfies Postfix's internal validation checks, completely silencing the log noise.
tls_config_file = /etc/postfix/tls_config.conf
tls_config_name = postfix
What they do: This maps Postfix's internal TLS initialization routines to your custom /etc/postfix/tls_config.conf configuration hook. It bridges the gap between Postfix's settings and your low-level OpenSSL parameters, allowing your custom definitions for signature hashing layers and allowed elliptic curves to actively bind to your network sockets.
once all the changes are made, check the configs and restart the services
dovecot -n > /dev/null
postfix check
systemctl restart dovecot
systemctl restart postfix
rerun your mailserver check at internet.nl and you should now get green ticks for all the TLS stuff..
