Revision as of 11:22, 27 April 2015 by Irfan (talk | contribs) (Ciphers)

Admin Article

Article Information

This article applies to the following ZCS versions.

ZCS 8.6 Article ZCS 8.6

Security Settings for Zimbra Collaboration 8.6 series



The single valued zimbraReverseProxySSLCiphers attribute configures what cipher suites the nginx proxy will allow to be negotiated over SSL. This affects HTTPS when the web proxy is enabled, and POP and IMAP when the mail proxy is enabled. It is only possible to set this value in globalconfig.

The current recommended setting is (removes RC4 from the default in 8.6):


It can be set using the zmprov mcf command:

$ zmproxyctl restart # on all proxies

Ciphers: Potential Impacts

  • To support some older clients, like Outlook 2011 for Mac, one would need to remove the !3DES from this setting (see: bug 97232).
  • For 8.7 !RC4 will be in the default value for zimbraReverseProxySSLCiphers and an upgrade step will update the key if the key has not been changed from the old default (ref: bug 96852)
    • Note: with the "Bar Mitzvah" attack [1], it is definitely now recommended to disable RC4 on all Zimbra ZCS versions.


The multi-valued attribute controlling the acceptable TLS protocol versions to be used by the nginx proxy is zimbraReverseProxySSLProtocols. It can be set at both the globalconfig and server level.

The current recommend values for this attribute are:


The values can be modified to either add or remove a protocol:

zmprov mcf zimbraReverseProxySSLProtocols +protocol # add a protocol at the globalconfig level

zmprov mcf zimbraReverseProxySSLProtocols -protocol # remove a protocol at the globalconfig level

If it is desired to have the servers have different protocol level settings, this can be done by setting the values at the server level:

zmprov ms hostname zimbraReverseProxySSLProtocols +protocol # add a protocol at the server level

zmprov ms hostname zimbraReverseProxySSLProtocols -protocol # remove a protocol at the server level

Mailboxd (Jetty)


The multi-valued attributes controlling the acceptable TLS ciphers to be used by mailboxd are zimbraSSLExcludeCipherSuites and zimbraSSLIncludeCipherSuites. They can be set at the globalconfig level.

excluded cipher suites
List of included cipher suites for Jetty. If any value is set only these ciphers will be used, in effect superseding zimbraSSLExcludeCipherSuites. Controlling the cipher suite order will be handled as part of bug 96928.

Default zimbraSSLExcludeCipherSuites settings in 8.6.0 (changing defaults to be addressed in bug 96921):


Recommended (*may break compatibility with clients with limited capabilities):


Ciphers: Potential Impacts

  • Excluding RC4 will likely cause problems for Windows XP users, and possibly other old clients.
  • Keeping 3DES may still be desirable for interoperability with old clients, including Outlook 2011 for Mac.



contains a list of SSL/TLS protocols (as documented by SunJSSE Provider Protocols and used in setEnabledProtocols) to be enabled in Jetty for HTTPS, IMAPS, POP3S, and STARTTLS (including LMTP)

The current recommend values for this attribute are:


Protocols: Potential impacts

  • Adding SSLv2Hello may be desirable for interoperability with old clients, including Outlook 2011 for Mac and Clients using Java 6 (see: bug 97332). Please note: Enabling SSLv2Hello does not mean that the server is actually allowing SSLv2, but it does mean that it allows the SSLv2Hello "introduction" before switching to TLSv1 or greater. One known downside of the SSLv2Hello is that it does not support the Server Name Indication TLS extension.

See also:

HTTP Strict Transport Security (HSTS)

The configuration key, 'zimbraResponseHeader', can be used to set the HSTS header. For example (ref: bug 84796):

zmprov mcf +zimbraResponseHeader "Strict-Transport-Security: max-age=31536000"


The single-valued localconfig attributes controlling the acceptable TLS protocol versions and ciphers to be used by the OpenLDAP server are ldap_common_tlsprotocolmin and ldap_common_tlsciphersuite.


Specifies minimum SSL/TLS protocol version that will be negotiated. To require TLS 1.x or higher, set this option to 3.(x+1), e.g., a value of 3.2 would require TLS 1.1.



Configures what ciphers will be accepted and the preference order for OpenSSL. To check what ciphers a given spec selects in OpenSSL, use: openssl ciphers -v cipher-suite-spec

The current recommend values for these localconfig settings are:

ldap_common_tlsprotocolmin = "3.1"
ldap_common_tlsciphersuite = "MEDIUM:HIGH"

For more details see olcTLSCipherSuite and olcTLSProtocolMin in the OpenLDAP man page for slapd-config(5).



The current recommend values for the MTA's protocol attributes are:

zimbraMtaSmtpdTlsProtocols = !SSLv2, !SSLv3
zimbraMtaLmtpTlsProtocols  = !SSLv2, !SSLv3

However, please note: bug 97186 exists to address the lack of support for controls on mandatory protocols in postfix:

zimbraMtaSmtpdTlsMandatoryProtocols (smtpd_tls_mandatory_protocols)
zimbraMtaSmtpTlsMandatoryProtocols  (smtp_tls_mandatory_protocols)
zimbraMtaLmtpTlsMandatoryProtocols  (lmtp_tls_mandatory_protocols)


The current recommend values for the MTA's ciphers attributes are:

zimbraMtaSmtpTlsCiphers = export
zimbraMtaSmtpTlsMandatoryCiphers = export,low,medium,high,null
zimbraMtaSmtpdTlsCiphers = export
zimbraMtaSmtpdTlsExcludeCiphers = (empty)
zimbraMtaSmtpdTlsMandatoryCiphers = medium
zimbraMtaLmtpTlsCiphers = export
zimbraMtaLmtpTlsExcludeCiphers  = (empty)
zimbraMtaLmtpTlsMandatoryCiphers = export,low,medium,high,null

For more details on Postfix TLS settings see

Further Research and Reading

Verified Against: Zimbra Collaboration 8.6 Date Created: 12/12/2014
Article ID: Date Modified: 2015-04-27

Try Zimbra

Try Zimbra Collaboration with a 60-day free trial.
Get it now »

Want to get involved?

You can contribute in the Community, Wiki, Code, or development of Zimlets.
Find out more. »

Looking for a Video?

Visit our YouTube channel to get the latest webinars, technology news, product overviews, and so much more.
Go to the YouTube channel »

Jump to: navigation, search