Solved 10.1-RELEASE-p13 sendmail dh key too small

Anubas

Anubas

I just upgraded to 10.1-RELEASE-p13 and am still seeing the following error in /var/log/maillog when trying to send mail.

Code: 
Jun 19 13:55:06 server sendmail[1794]: STARTTLS=client, error: connect failed=-1, reason=dh key too small, SSL_error=1, errno=0, retry=-1

I thought that p13 fixed this issue. Did I misunderstand the errata notice?
https://www.freebsd.org/security/advisories/FreeBSD-EN-15:08.sendmail.asc

Thanks!


Note: Prior to the p13 release, I used the following commands on other servers to fix this issue.

Code: 
cd /etc/mail/certs
sudo openssl dhparam -out dh.param -2 2048
sudo service sendmail restart
 
The workaround section is what you follow if you are not going to patch your system, correct? If that is the case, then the dh.param regeneration steps should also be added to the solution section if they are required. If the regeneration steps are not required then p13 does not fully solve the problem.
 
You must log in or register to reply here.
Back
Top