The default algorithm is md5; this is consistent with the backwards compatible setting of the digest used to verify client -certificates in the SMTP server.
+certificates in the SMTP server. Any other digest algorithm supported +by your OpenSSL library (and enabled via OpenSSL_add_ssl_algorithms()) +may be used instead. See the manpage for the OpenSSL "dgst" command for +the list of implemented algorithms. -The best practice algorithm is now sha1. Recent advances in hash -function cryptanalysis have led to md5 being deprecated in favor of sha1. -However, as long as there are no known "second pre-image" attacks -against md5, its use in this context can still be considered safe. -
- -While additional digest algorithms are often available with OpenSSL's -libcrypto, only those used by libssl in SSL cipher suites are available to -Postfix. For now this means just md5 or sha1.
+Advances in hash function cryptanalysis have led to MD5 being +deprecated in favor of SHA1 and more recently SHA2 (i.e. SHA224, SHA256, +SHA384 and SHA512). However, as long as there are no known "second +pre-image" attacks against MD5, its use in this context can still be +considered safe.
To find the fingerprint of a specific certificate file, with a specific digest algorithm, run: @@ -12342,21 +12341,21 @@ configuration parameter. See there for details.
%PARAM smtpd_tls_fingerprint_digest md5The message digest algorithm to construct remote SMTP -client-certificate -fingerprints or public key fingerprints (Postfix 2.9 and later) -for check_ccert_access and permit_tls_clientcerts. The -default algorithm is md5, for backwards compatibility with Postfix -releases prior to 2.5.
+client-certificate fingerprints or public key fingerprints +(Postfix 2.9 and later) for check_ccert_access and +permit_tls_clientcerts. The default algorithm is md5, +for backwards compatibility with Postfix releases prior to 2.5. -Advances in hash -function cryptanalysis have led to md5 being deprecated in favor of sha1. -However, as long as there are no known "second pre-image" attacks -against md5, its use in this context can still be considered safe. -
+Any other digest algorithm supported by your OpenSSL library (and +enabled via OpenSSL_add_ssl_algorithms()) may be used instead. See +the manpage for the OpenSSL "dgst" command for the list of implemented +algorithms.
-While additional digest algorithms are often available with OpenSSL's -libcrypto, only those used by libssl in SSL cipher suites are available to -Postfix.
+Advances in hash function cryptanalysis have led to MD5 being +deprecated in favor of SHA1 and more recently SHA2 (i.e. SHA224, SHA256, +SHA384 and SHA512). However, as long as there are no known "second +pre-image" attacks against MD5, its use in this context can still be +considered safe.
To find the fingerprint of a specific certificate file, with a specific digest algorithm, run: