give PFS a chance

3 years ago · 1df79f8132
parent 3a96bf2170
commit 1df79f8132
1 changed files with 1 additions and 1 deletions
--- a/core/postfix/conf/main.cf
+++ b/core/postfix/conf/main.cf
@ -50,7 +50,7 @@ smtpd_authorized_xclient_hosts={{ POD_ADDRESS_RANGE or SUBNET }}
 # General TLS configuration
 tls_high_cipherlist = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA
 tls_preempt_cipherlist = yes
-tls_ssl_options = NO_COMPRESSION
+tls_ssl_options = NO_COMPRESSION, NO_TICKET

 # By default, outgoing TLS is more flexible because
 # 1. not all receiving servers will support TLS,