Updated copyright notices to include the year 2018.

lib-master: Fix master_service_ssl_settings_to_iostream_set() for client settings ssl_verify_client_cert setting applies only to server side. For client side we always verify the SSL certificate validity.

Replace ssl_protocols config option with ssl_min_protocol Default to TLSv1.

lib-master: Drop support for SSL_TXT_SSLV2 in master-service-ssl-settings.c OpenSSL headers are not included in master-service-ssl-settings.c, so the check for SSL_TXT_SSLV2 is broken at the moment, and the feature is not worth supporting since SSLv2 is obsolete.

lib-master: master_service_ssl_settings_to_iostream_set() - add client/server parameter

lib-master: master_service_ssl_settings_to_iostream_set() - reorder assignments Keep them in the same order as the fields in struct ssl_iostream_settings, so it's easier to verify whether all fields are listed.

lib-master: master_service_ssl_settings_to_iostream_set() - add ssl_require_crl

lib-master: master_service_ssl_settings_to_iostream_set() - don't go through master_service It's more useful to convert any master_service_ssl_settings struct.

lib-master: Add ssl_client_ca_file & _dir to master_service_ssl_settings

lib-master: Add master_service_ssl_settings_to_iostream_set

lib-master,login-common: Add dual cert support Adds new settings ssl_alt_cert and ssl_alt_key

ssl: deprecate no_compression in ssl_options Compression is now disabled by default.

ssl: change to more secure default ssl_cipher_list

ssl: add ssl_curve_list setting for selecting ECHDE curves

Updated copyright notices to include the year 2017.

ssl: fix reference to SSLv2 and disable SSLv3 This is driven by the fact that OpenSSL 1.1 does not know about SSLv2 at all and dovecot's defaults simply make OpenSSL error out with "Unknown protocol 'SSLv2'"[1]. So we change the defaults to refer to SSLv2 iff OpenSSL seems to know something about it. While at it, it's also a good idea to disable SSLv3 by default as well. [1] https://bugs.debian.org/844347 Signed-off-by: Apollon Oikonomopoulos <apoikos@debian.org>

doveconf: Fix ssl_dh parameter handling some more Move empty check to master-service ssl settings, also handle ENOENT in read as well. Do not touch the setting if it could not be composed due to no such file.

config: Use ssl-parameters.dat if ssl_dh is missing

lib-master: Load DH string from config file

global: freshen copyright git ls-files | xargs perl -p -i -e 's/(\d+)-201[0-5]/$1-2016/g;s/ (201[0-5]) Dovecot/ $1-2016 Dovecot/'

ssl_options: Added support for no_ticket

global: freshen copyright Robomatically: git ls-files | xargs perl -p -i -e 's/(\d+)-201[0-4]/$1-2015/g;s/ (201[0-4]) Dovecot/ $1-2015 Dovecot/' Happy 2015 everyone! Signed-off-by: Phil Carmody <phil@dovecot.fi>

openssl: optionally disable TLS compression Make ssl compression optional, but enabled by default. Other ssl options might be tweakable in the future, so have a single ssl_options string, and explode it into individual flags. (Compare postfix configuration.) Based on an idea by Andreas Schulze <sca@andreasschulze.de> Signed-off-by: Phil Carmody <phil@dovecot.fi>

Updated copyright notices to include year 2014.

Added ssl_prefer_server_ciphers setting.

Oops :) Update copyrights to 2013 without breaking all .c files.

Updated copyright notices to include year 2013.

Read SSL settings only if service has SSL sockets or MASTER_SERVICE_FLAG_USE_SSL_SETTINGS.

lib-master: Check ssl_cert/ssl_key only when running in config/doveconf. Also if Dovecot isn't built with SSL, default to ssl=no

Moved ssl_* settings from login-common to lib-master. This allows creating other SSL servers more easily.