Force InterScan Messaging Security Virtual Appliance (IMSVA) to use 2048-bit Diffie-Hellman (DH) parameters for TLS connections

Product / Version includes:

Interscan Messaging Security Virtual ApplianceAll

Last updated: 2022/03/03

Solution ID: KA-0010306

Category: Configure

Summary

By default, the postfix module in IMSVA uses 1024-bit Diffie-Hellman (DH) parameters for TLS connections. For security reasons some customers may require a larger key size, like for example, 2048-bit.

This article explains the steps that need to be followed to configure 2048-bit DH parameters in postfix.

Important: By setting a larger key size, some external servers that do not support such parameters might not be able to connect anymore.

This solution can be used also when the following error is present:

DH key too small

1. Access IMSVA via SSH using your root credentials.

2. Create a backup of the main.cf file located under /opt/trend/imss/postfix/etc/postfix/ directory.

3. Generate 2048 bit DH parameters:

# openssl dhparam -out dh2048.tmp 2048 && mv dh2048.tmp dh2048.pem

4. Copy the created .pem file to the postfix location:

# cp dh2048.pem /opt/trend/imss/postfix/etc/postfix/

5. Change the permissions of the created .pem file:

# chmod 644 /opt/trend/imss/postfix/etc/postfix/dh2048.pem

6. Update the postfix configuration pointing to the new file:

# postconf -e 'smtpd_tls_dh1024_param_file=/opt/trend/imss/postfix/etc/postfix/dh2048.pem'

7. Reload the postfix configuration

# postfix reload

Was this article helpful?

Featured

Automation Center

Education Portal

Online Help Center

Service Status

TrendConnect

Force InterScan Messaging Security Virtual Appliance (IMSVA) to use 2048-bit Diffie-Hellman (DH) parameters for TLS connections

Force InterScan Messaging Security Virtual Appliance (IMSVA) to use 2048-bit Diffie-Hellman (DH) parameters for TLS connections

Product / Version includes:

Summary