Future: PQC TLSv1.3 for Postfix

[feld]

From Postfix docs:

Example: Custom OpenSSL group settings.

main.cf:

    tls_config_file = ${config_directory}/openssl.cnf
    tls_config_name = postfix
    # Clear Postfix curve/group settings to let custom OpenSSL
    # configuration settings take effect.  For most users, the
    # default Postfix settings are strongly recommended.
    tls_eecdh_auto_curves =
    tls_ffdhe_auto_groups =

openssl.cnf:

    postfix = postfix_settings

    [postfix_settings]
    ssl_conf = postfix_ssl_settings

    [postfix_ssl_settings]
    system_default = baseline_postfix_settings

    [baseline_postfix_settings]
    # New OpenSSL 3.5 syntax, for older releases consider
    # the Postfix default:
    #
    # Groups = X25519:X448:prime256v1:secp384r1:secp521r1:ffdhe2048:ffdhe3072
    #
    Groups = ?X25519MLKEM768 / ?*X25519:?secp256r1 / ?X448:?secp384r1:?secp521r1 / ?ffdhe2048:?ffdhe3072

We can do this once we have relays able to deploy on Debian Trixie (OpenSSL 3.5). There are probably similar knobs for Dovecot as well that need to be investigated.

command for testing: openssl s_client -tls1_3 -groups X25519MLKEM768 -starttls smtp -connect mx.example.com:25