custom-ciphers <ciphers_str>

Select which ciphers FortiMail will accept in HTTPS and SMTPS secure connections from clients.

To display a list of cipher options and the current selection, type:

set custom-ciphers ?

In the Available ciphers section is the list of ciphers that this FortiMail firmware version supports. In the Selected ciphers section is the list ciphers that you have selected to allow.

To add cipher suites to the list, type + before the name of each cipher, and separate multiple names with spaces, such as:

+RC4-SHA +CAMELLIA256-SHA

To delete cipher suites from the list, type - before the name of each cipher, and separate multiple names with spaces, such as:

-RC4-SHA -CAMELLIA256-SHA

Alternatively, for FIPS-CC compliance, configure status {disable | fips-ciphers} instead.

dh-params {1024 | 2048 | 3072 | 4096}

Enter the minimum size of the Diffie-Hellman prime number for secure connections such as SSH, SMTPS, and HTTPS. Larger bit sizes are slower to generate, but generally more secure.

Alternatively, you can set the Diffie-Hellman bit size globally. See system global.

ssl-versions {tls1_0 tls1_1 tls1_2 tls1_3}

Select which SSL/TLS version(s) FortiMail will accept in secure connections:

• from clients (HTTPS web browsers and SMTPS mail clients)
• to servers (protected mail servers and Syslog with TCP over TLS)

Separate multiple versions with a space.

Alternatively, you can select SSL/TLS versions globally. See system global.

Note: Some old versions of web browsers, email clients (for example, Microsoft Outlook 2007 and older), MTAs only support TLS 1.0. Therefore they cannot connect to FortiMail if you enable strong-crypto {enable | disable} and/or disable TLS 1.0.

status {enable | disable}

Enable to override the global settings, and apply protocol-specific cryptography settings.

Disable to use system-wide settings in system global.