# How to re-enable TLS 1.0 in MIAB

**URL:** <https://discourse.mailinabox.email/t/how-to-re-enable-tls-1-0-in-miab/7545>\
**Category:** Help with Setup/Upgrade\
**Created:** [January 20, 2021, 7:46am UTC](https://discourse.mailinabox.email/t/how-to-re-enable-tls-1-0-in-miab/7545 "2021-01-20T07:46:47Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![Zacktamondo](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/z/dbc845/32.png) [@Zacktamondo](https://discourse.mailinabox.email/u/Zacktamondo)\
**Post date:** [January 20, 2021, 7:46am UTC](https://discourse.mailinabox.email/t/how-to-re-enable-tls-1-0-in-miab/7545/1 "2021-01-20T07:46:47Z")

</div>

I installed the latest version of MIAB but I want to re-enable TLS 1.0 for the time being because not all the users using a new and updated email clients.  
I followed [this](https://discourse.mailinabox.email/t/warning-tls-library-problem-when-trying-to-send-mail-from-phpmailer-after-upgrade/6221/4) but it only allowed me to send emails and not receiving them using POP3.  
Thank you all for your time.

---

<div class="post-metadata">

**Author:** ![alento](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/alento/32/1371_2.png) [@alento](https://discourse.mailinabox.email/u/alento)\
**Post date:** [January 20, 2021, 9:17am UTC](https://discourse.mailinabox.email/t/how-to-re-enable-tls-1-0-in-miab/7545/2 "2021-01-20T09:17:47Z")

</div>

One word … don’t.

Your users need to get into the 21st century and update their email clients.

Why sacrifice the security of everyone’s email system for a few hold outs? It is not worth it IMHO. Maybe you didn’t ask my opinion? That’s fine. Take it or leave it.

---

<div class="post-metadata">

**Author:** ![Zacktamondo](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/z/dbc845/32.png) [@Zacktamondo](https://discourse.mailinabox.email/u/Zacktamondo)\
**Post date:** [January 20, 2021, 10:16am UTC](https://discourse.mailinabox.email/t/how-to-re-enable-tls-1-0-in-miab/7545/3 "2021-01-20T10:16:44Z")

</div>

I know it’s not recommended and it’s bad practice and I totally agree with you, but this is what my management requested, so that’s why I am asking.  
Thank you for your reply and your time.

---

<div class="post-metadata">

**Author:** ![alento](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/alento/32/1371_2.png) [@alento](https://discourse.mailinabox.email/u/alento)\
**Post date:** [January 20, 2021, 10:29am UTC](https://discourse.mailinabox.email/t/how-to-re-enable-tls-1-0-in-miab/7545/4 "2021-01-20T10:29:07Z")

</div>

Try this thread then:

> [@Heads up before upgrading to 0.44 if you have macOS 10.11 users](https://discourse.mailinabox.email/t/heads-up-before-upgrading-to-0-44-if-you-have-macos-10-11-users/6059):
>
> If you have clients using macOS 10.11 El Capitan, they will not be able to connect to MIAB 0.44. macOS 10.11 has TLS 1.2 support, but (annoyingly) Apple Mail 9.3 (the version in that OS) does not, and MIAB 0.44 is configured to only use 1.2 and 1.3. I solved this by re-enabling TLSv1 in both postfix and dovecot. I wish I didn’t have to, but my users win, and the hardware they are on won’t run a later macOS…

I have no idea if it will help or not as I am completely against doing something as insecure as what your bosses are telling you to do. You did warn them of the consequences I presume?

---

<div class="post-metadata">

**Author:** ![Zacktamondo](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/z/dbc845/32.png) [@Zacktamondo](https://discourse.mailinabox.email/u/Zacktamondo)\
**Post date:** [January 20, 2021, 11:33am UTC](https://discourse.mailinabox.email/t/how-to-re-enable-tls-1-0-in-miab/7545/5 "2021-01-20T11:33:06Z")

</div>

Yes I warned them on and on but they still want to stick to their opinion.  
They say ‘A working email for all, is better than a secure email working for some people’.  
Thank you for your time.

---

<div class="post-metadata">

**Author:** ![Zacktamondo](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/z/dbc845/32.png) [@Zacktamondo](https://discourse.mailinabox.email/u/Zacktamondo)\
**Post date:** [January 20, 2021, 1:14pm UTC](https://discourse.mailinabox.email/t/how-to-re-enable-tls-1-0-in-miab/7545/6 "2021-01-20T13:14:05Z")

</div>

To any one that may have a problem like mine this is what worked for me to make it work on old machines using outlook 2013 on windows 7.  
Edit Dovecot settings for POP3 and IMAP:  
In /etc/dovecot/conf.d/10-ssl.conf:

```auto
ssl_protocols=TLSv1.2 TLSv1.1 TLSv1
ssl_cipher_list=ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS

```

Edit Postfix config for SMTP:  
In /etc/postfix/main.cf:

```auto
smtpd_tls_ciphers=medium
smtp_tls_mandatory_protocols=!SSLv2,!SSLv3,!TLSv1,!TLSv1.1
smtpd_tls_mandatory_protocols=!SSLv2,!SSLv3,!TLSv1,!TLSv1.1
smtpd_tls_mandatory_ciphers=medium
smtp_tls_mandatory_ciphers=medium

```

Thank you @alento for your help and time.

---

<div class="post-metadata">

**Author:** ![S4\_Hosting](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/s4_hosting/32/1465_2.png) [@S4\_Hosting](https://discourse.mailinabox.email/u/S4_Hosting)\
**Post date:** [January 21, 2021, 11:52pm UTC](https://discourse.mailinabox.email/t/how-to-re-enable-tls-1-0-in-miab/7545/7 "2021-01-21T23:52:23Z")

</div>

Glad you found a solution but absolutely amazed by that incredible view of security at the place you work.

---

<div class="post-metadata">

**Author:** ![davness](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/davness/32/2054_2.png) [@davness](https://discourse.mailinabox.email/u/davness)\
**Post date:** [January 22, 2021, 2:45am UTC](https://discourse.mailinabox.email/t/how-to-re-enable-tls-1-0-in-miab/7545/8 "2021-01-22T02:45:43Z")

</div>

Just an heads-up here, the MIAB config scripts overwrite configuation files. So whenever you upgrade the server don’t forget to redo the changes.

Also a good idea to try and get people to update their client software so that when everyones ready you can ditch TLS1.0 for good.

---

<div class="post-metadata">

**Author:** ![daveteu](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/d/b5e925/32.png) [@daveteu](https://discourse.mailinabox.email/u/daveteu)\
**Post date:** [January 22, 2021, 4:55am UTC](https://discourse.mailinabox.email/t/how-to-re-enable-tls-1-0-in-miab/7545/9 "2021-01-22T04:55:27Z")

</div>

There is a very nice python script in mailinabox/tools which you may want to use. (I recommend you to test and backup first before production).

You may create a `custom.sh` file in your home directory with the following content as **example** (edit file path and content as desire).

```
#!/bin/bash

mailinabox/tools/editconf.py /etc/postfix/main.cf \
smtpd_tls_ciphers=medium \
smtp_tls_mandatory_protocols="!SSLv2,!SSLv3,!TLSv1,!TLSv1.1" \
smtpd_tls_mandatory_protocols="!SSLv2,!SSLv3,!TLSv1,!TLSv1.1" \
smtpd_tls_mandatory_ciphers=medium \
smtp_tls_mandatory_ciphers=medium 

```

Chmod to make script executable.

`chmod +x custom.sh`

After every update runs you can do a ./custom.sh and it will overwrite the config file with your custom settings

Disclaimer: modification is at your own risk.

---

<div class="post-metadata">

**Author:** ![Zacktamondo](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/z/dbc845/32.png) [@Zacktamondo](https://discourse.mailinabox.email/u/Zacktamondo)\
**Post date:** [January 25, 2021, 7:31am UTC](https://discourse.mailinabox.email/t/how-to-re-enable-tls-1-0-in-miab/7545/10 "2021-01-25T07:31:59Z")

</div>

I know I was surprised too when they told me what they decided.

---

<div class="post-metadata">

**Author:** ![Zacktamondo](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/z/dbc845/32.png) [@Zacktamondo](https://discourse.mailinabox.email/u/Zacktamondo)\
**Post date:** [January 25, 2021, 7:32am UTC](https://discourse.mailinabox.email/t/how-to-re-enable-tls-1-0-in-miab/7545/11 "2021-01-25T07:32:40Z")

</div>

I am aware of that thank you for the reminder.

---

<div class="post-metadata">

**Author:** ![Zacktamondo](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/z/dbc845/32.png) [@Zacktamondo](https://discourse.mailinabox.email/u/Zacktamondo)\
**Post date:** [January 25, 2021, 7:33am UTC](https://discourse.mailinabox.email/t/how-to-re-enable-tls-1-0-in-miab/7545/12 "2021-01-25T07:33:09Z")

</div>

I will keep that in mind and test it.

---

<div class="post-metadata">

**Author:** ![system](https://discourse.mailinabox.email/uploads/default/original/2X/4/4d0933d13c456b7e57f296aa6cc344525b6f0c70.png) [@system](https://discourse.mailinabox.email/u/system)\
**Post date:** [February 1, 2021, 7:33am UTC](https://discourse.mailinabox.email/t/how-to-re-enable-tls-1-0-in-miab/7545/13 "2021-02-01T07:33:12Z")

</div>

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.