View source for TLS/STARTTLS Localconfig Values

{{BC|Community Sandbox}}
__FORCETOC__
<div class="col-md-12 ibox-content">
= TLS/STARTTLS LocalConfig Values =
{{KB|{{ZC}}|{{ZCS 8.0}}|{{ZCS 7.0}}|{{ZCS 6.0}}||}}
{{WIP}}
The following are security-related localconfig values. They following commands are run as the user ''zimbra''.  Restarting ZCS is required for the localconfig changes to go into effect.

== zimbra_require_interprocess_security ==
'''zimbra_require_interprocess_security''' - LC key, defaults to 1 (True).

This setting determines if ZCS requires SSL/TLS for inter-process communications, such as LDAP and SMTP.  As of ZCS8, it is recommended that this is always left enabled.

 zmlocalconfig -e zimbra_require_interprocess_security=1

Note: Versions prior to ZCS8 sometimes set this to 0 to work around limitation in the mechanisms that were used to talk to LDAP over TLS which could limit performance and connection fail-over.  Those issues were fixed in ZCS8.  If necessary, disable it with:

 zmlocalconfig -e zimbra_require_interprocess_security=0

See also: [[Performance_Tuning_Guidelines_for_Large_Deployments|Zimbra Performance Tuning]]

== ldap_starttls_supported ==
'''ldap_starttls_supported''' - LC key, defaults to 1 (True).

Enables/disables if the LDAP server supports STARTTLS, and whether the LDAP client in the mailbox server, Postfix, and Amavis servers use TLS to communicate with the LDAP server.  It is recommended to leave this enabled:

 zmlocalconfig -e ldap_starttls_supported=1

== ldap_starttls_required ==
'''ldap_starttls_required''' - LC key, defaults to "true".

Determines if starttls is required for java LDAP clients when  connecting to the Zimbra LDAP server.  As of ZCS8, it is recommended that this is always left enabled.

 zmlocalconfig -e ldap_starttls_required=true

Note: Similar to '''zimbra_require_interprocess_security''' above, if TLS is causing performance issues on older ZCS installations (before ZCS8), disable it with:
 
 zmlocalconfig -e ldap_starttls_required=false

== ldap_common_require_tls ==
'''ldap_common_require_tls''' - LC key, defaults to "0".

Controls OpenLDAP's required Security Strength Factors (SSF) level, which is an indication of relative strength of protection. A SSF greater than one (>1) roughly correlates to the effective encryption key length. The value sets the minimum security strength to require for connections. In general, this will be 128, but it depends on the strength of your generated cert/keys. You can view your ldap log level at 256 level to see what current strength incoming connections are using.

To disable it (if not still at the default):

 zmlocalconfig -e ldap_common_require_tls=0

= History =
The following bugs may be useful when looking back at how various SSL/TLS related settings have evolved in the product:
* ZCS5 [https://bugzilla.zimbra.com/show_bug.cgi?id=24762 Bug 24762] zimbra_require_interprocess_security
* ZCS5 [https://bugzilla.zimbra.com/show_bug.cgi?id=16601 bug 16601] ldap_starttls_supported
* ZCS5 [https://bugzilla.zimbra.com/show_bug.cgi?id=29600 bug 29600] and [https://bugzilla.zimbra.com/show_bug.cgi?id=28814 bug 28814] ssl_allow_untrusted_certs and ssl_allow_mismatched_certs
* ZCS6 [https://bugzilla.zimbra.com/show_bug.cgi?id=20739 bug 20739] ldap_require_tls
* ZCS6 [https://bugzilla.zimbra.com/show_bug.cgi?id=20972 bug 20972] ldap_common_require_tls

{{Article Footer|Zimbra Collaboration 8.0, 7.0, 6.0|04/16/2014}}