• [^] # Re: Hardenize voit autre chose

    Posté par . En réponse au journal STARTTLS et laposte.net. Évalué à 8.

    Et openssl fait marcher la chose :

    ~ ⏰5s441ms[130] ❯ openssl s_client -connect smtpz4.laposte.net:25 -starttls smtp
CONNECTED(00000003)
depth=2 OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
verify return:1
depth=1 C = BE, O = GlobalSign nv-sa, CN = GlobalSign Extended Validation CA - SHA256 - G3
verify return:1
depth=0 businessCategory = Private Organization, serialNumber = 356 000 000, jurisdictionC = FR, C = FR, ST = \C38円Ele-de-France, L = Paris, O = LA POSTE SA, CN = smtp.laposte.net
verify return:1
---
Certificate chain
 0 s:businessCategory = Private Organization, serialNumber = 356 000 000, jurisdictionC = FR, C = FR, ST = \C38円Ele-de-France, L = Paris, O = LA POSTE SA, CN = smtp.laposte.net
 i:C = BE, O = GlobalSign nv-sa, CN = GlobalSign Extended Validation CA - SHA256 - G3
 a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
 v:NotBefore: Dec 6 10:11:06 2022 GMT; NotAfter: Jan 7 10:11:05 2024 GMT
 1 s:C = BE, O = GlobalSign nv-sa, CN = GlobalSign Extended Validation CA - SHA256 - G3
 i:OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
 a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
 v:NotBefore: Sep 21 00:00:00 2016 GMT; NotAfter: Sep 21 00:00:00 2026 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIG4TCCBcmgAwIBAgIMRALGpov9E6e+yf1XMA0GCSqGSIb3DQEBCwUAMGIxCzAJ
BgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMTgwNgYDVQQDEy9H
bG9iYWxTaWduIEV4dGVuZGVkIFZhbGlkYXRpb24gQ0EgLSBTSEEyNTYgLSBHMzAe
Fw0yMjEyMDYxMDExMDZaFw0yNDAxMDcxMDExMDVaMIGxMR0wGwYDVQQPDBRQcml2
YXRlIE9yZ2FuaXphdGlvbjEUMBIGA1UEBRMLMzU2IDAwMCAwMDAxEzARBgsrBgEE
AYI3PAIBAxMCRlIxCzAJBgNVBAYTAkZSMRcwFQYDVQQIDA7DjmxlLWRlLUZyYW5j
ZTEOMAwGA1UEBxMFUGFyaXMxFDASBgNVBAoTC0xBIFBPU1RFIFNBMRkwFwYDVQQD
ExBzbXRwLmxhcG9zdGUubmV0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEApqNp0+1sFaLHY9n0WfIWgyalRY2wImvCIvdjog7GGx9bM3z2DWMc3A/5ljq6
gp0KywHF1m+Efpzl9Ca7JIYGS3IKUPrco8r8oVJPGvEHHo3zMamh1wggdHsXQkPy
prwPcxX84KPGKc8ql7CTXm5xJuL/4RTCu6LYU8EzbN7bHbvNM/xI7IdCCvySmGX2
HE6DDuZhKcrcVrAGL26D7LmBL9eStC/scCuDoTlrP79hEwWkQxKERsYQXM7iMFhN
H8tPXxnnwuViId6DmXw8HeAEmxa3Bayd+xc5cJzfCoGJ2dSTtzYOGmJCjKl/j9+s
Q/2caA4FVxGyJU25duJS0mb+FQIDAQABo4IDRTCCA0EwDgYDVR0PAQH/BAQDAgWg
MIGWBggrBgEFBQcBAQSBiTCBhjBHBggrBgEFBQcwAoY7aHR0cDovL3NlY3VyZS5n
bG9iYWxzaWduLmNvbS9jYWNlcnQvZ3NleHRlbmR2YWxzaGEyZzNyMy5jcnQwOwYI
KwYBBQUHMAGGL2h0dHA6Ly9vY3NwMi5nbG9iYWxzaWduLmNvbS9nc2V4dGVuZHZh
bHNoYTJnM3IzMFUGA1UdIAROMEwwQQYJKwYBBAGgMgEBMDQwMgYIKwYBBQUHAgEW
Jmh0dHBzOi8vd3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMAcGBWeBDAEB
MAkGA1UdEwQCMAAwUgYDVR0RBEswSYIQc210cC5sYXBvc3RlLm5ldIIQaW1hcC5s
YXBvc3RlLm5ldIIPcG9wLmxhcG9zdGUubmV0ghJzbXRwejQubGFwb3N0ZS5uZXQw
HQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB8GA1UdIwQYMBaAFN2z522o
LujFTm7PdOZ1PJQVzugdMB0GA1UdDgQWBBQFf7vTVrOFCJsx51iFgi55sKW0/DCC
AX8GCisGAQQB1nkCBAIEggFvBIIBawFpAHYAb1N2rDHwMRnYmQCkURX/dxUcEdkC
wQApBo2yCJo32RMAAAGE5urvnQAABAMARzBFAiAUueGascFcEL7nIHY5aS47lY4c
mh2Ve5d5tQ64r9ND+QIhAPAa3f+kVgPrtJcGXyY9jy1y8CZrJy2VZbiLCZ3lHiXI
AHYAc9meiRtMlnigIH1HneayxhzQUV5xGSqMa4AQesF3crUAAAGE5urvxwAABAMA
RzBFAiEAmMX5rZNHq212hJbmlbjdSpGbdeDOjGGJYoxMkmZT2/kCIE1icRxr9Sx6
7tPFjD6fLpx21/i4SmB4/uL2pV9rqvqbAHcA7s3QZNXbGs7FXLedtM0TojKHRny8
7N7DUUhZRnEftZsAAAGE5urvmQAABAMASDBGAiEAtedHA4yGV84J7Q7/ZxiKuUAN
mKlVbDSD15/gIoNJlosCIQC9YgFyf5P+D9hUZdDOoHzbaX7Ahmr2Mx2V+SnjSLM8
UzANBgkqhkiG9w0BAQsFAAOCAQEAgLI7Og3RnOTYb5+dVczhsAWZBnyx4i76VHgk
jnnUB1GIWdhja5ZvxtQn+YzKTqFucwPHuX6aT+M72noiy77vcxjVbDF6Qk/TAmAg
IxJ+PYSkpgocTjR+Mz3PSreA6Rlqj1RyyF++tWIBb95fInJEprimakrpdxtRW6s1
5VT9gdqc6+phbg+bZFy3GXALbgltIVr4dNg7uCEw85xltHE6UMZSY6Z8frplpgmy
3wxyfBgtnweWJ+zUAx3A6P9hqm4wwspA1z78/rncCmYVW5jzPDBIMvR2D9we/1RF
eD525z8Vkag6Ywp99l3mNu9JV0o02LuCBTapJB+1EiSSNBAWqA==
-----END CERTIFICATE-----
subject=businessCategory = Private Organization, serialNumber = 356 000 000, jurisdictionC = FR, C = FR, ST = \C38円Ele-de-France, L = Paris, O = LA POSTE SA, CN = smtp.laposte.net
issuer=C = BE, O = GlobalSign nv-sa, CN = GlobalSign Extended Validation CA - SHA256 - G3
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA
Server Temp Key: ECDH, prime256v1, 256 bits
---
SSL handshake has read 3844 bytes and written 483 bytes
Verification: OK
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
 Protocol : TLSv1.2
 Cipher : ECDHE-RSA-AES256-GCM-SHA384
 Session-ID: 1948695C78B6EC3A7ACF79ACE501085E86468917C813B38A73CEDD1633951771
 Session-ID-ctx: 
 Master-Key: DC6F5BEFF447AE5E214C7FA587D3855B4F1DB08A8BAC6B96ABBDE8AFD6825FDE433CF26FC6F3C6E06C8A28FD2322A932
 PSK identity: None
 PSK identity hint: None
 SRP username: None
 TLS session ticket lifetime hint: 7200 (seconds)
 TLS session ticket:
 0000 - 72 49 4b 26 07 d6 e2 c3-2e 9b 6a 63 c6 31 aa 52 rIK&......jc.1.R
 0010 - f8 9d f0 35 e5 53 71 01-4c 33 3f ec 7b 8d ce b5 ...5.Sq.L3?.{...
 0020 - 10 b5 90 98 48 82 20 d2-62 85 5f 38 c3 f2 8e 68 ....H. .b._8...h
 0030 - 5c c5 e2 fe 06 5e 63 d1-df 0b 61 cf 35 41 a8 dc \....^c...a.5A..
 0040 - 10 b0 b1 1d cc a3 2a 0a-9e 86 92 a1 95 a6 10 fe ......*.........
 0050 - b6 4a 14 25 60 33 84 7c-37 5a 82 fd b1 4b d4 1e .J.%`3.|7Z...K..
 0060 - b6 9c ab e3 44 15 6a 9c-c3 27 47 a5 46 5a 62 2a ....D.j..'G.FZb*
 0070 - d8 f8 84 3a a9 a6 d4 80-63 1b 06 74 26 48 7a 51 ...:....c..t&HzQ
 0080 - 14 bd 8e 6d 78 c3 54 f4-5a 4e 3f c1 a2 d3 ae ea ...mx.T.ZN?.....
 0090 - bd ec 72 a5 53 f5 67 11-12 45 4d c3 4d 98 f0 58 ..r.S.g..EM.M..X
 00a0 - b3 79 41 5c 53 1b 13 4f-f0 eb 71 3c bd 9b 5e 82 .yA\S..O..q<..^.
 00b0 - 7c 0b fe cf 3b c7 c0 25-5b 3c 43 13 05 e0 41 62 |...;..%[<C...Ab
 Start Time: 1696424371
 Timeout : 7200 (sec)
 Verify return code: 0 (ok)
 Extended master secret: no
---
250 8BITMIME

    Alors je ne sais pas d’où viens l'erreur du journal, mais visiblement, ça peut marcher.