Subject: [TOOLS-DEVELOPMENT] SSLv3 for Postfix

From: Russ Housley <[email-masked]>
Date: Fri, 22 Jan 2016 16:58:55 -0500

SSLv3 is disabled on Apache, as I would expect.  However, I have just learned that SSLv3 is still enabled on Postfix for mail transport.  I think we should disable it.  Anyone disagree?

Russ

---

From: Henrik Levkowetz <[email-masked]>
Date: Fri, 22 Jan 2016 23:01:00 +0100

On 2016-01-22 22:58, Russ Housley wrote:
> SSLv3 is disabled on Apache, as I would expect.  However, I have just
> learned that SSLv3 is still enabled on Postfix for mail transport.  I
> think we should disable it.  Anyone disagree?

No.  I'm sure it will lead to someone being bothered, so it would be good
to announce it, though.

Best regards,

	Henrik

---

From: Russ Housley <[email-masked]>
Date: Fri, 22 Jan 2016 17:03:58 -0500

Jari:

Would you please handle the announcement.

Russ

---

From: Jari Arkko <[email-masked]>
Date: Sat, 23 Jan 2016 00:11:40 +0200

Is this the right announcement:

Subject: IETF mail server and SSLv3

For your information, while SSLv3 has been disabled on IETF web servers, it has still been enabled on mail transport. The tools is taking action to disable SSLv3 even on mail transport. After this, all IETF web and mail servers support only TLS-based transport on secure connections.

If you have any feedback regarding this, let me or the tools team know.

Jari Arkko, IETF Chair

---

From: Russ Housley <[email-masked]>
Date: Fri, 22 Jan 2016 17:28:14 -0500

Sounds right to me.

Russ