Older installations, such as trusty Debian Lenny, come with versions of OpenSSL 0.9.8. The default cipher suite used by TLS Interposer is very restrictive, on purpose. For OpenSSL 0.9.8g, the only remaining cipher is RC4-SHA.
Especially when configuring XMPP servers such as ejabberd to use TLS Interposer, RC4-SHA alone can be not enough (e.g., when connecting to servers such as jabber.ru, which has RC4 disabled entirely.
“TLS
- TLS Interposer
- Eliminate BEAST, CRIME, Lucky13, RC4, SSLv3 weaknesses from binary/legacy applications
- Upgrading Apache 2.2 OpenSSL security with TLS Interposer
- Upgrade ejabberd to the latest TLS security [UPDATE#2, 2014-06-05]
- Securing fetchmail with improved TLS parameters
- Using TLS Interposer with OpenSSL 0.9.8g (Debian Lenny)
- Disable client certificate requests for Cyrus IMAP
Therefore, please add
export TLS_INTERPOSER_CIPHERS="DHE-RSA-AES256-SHA AES256-SHA RC4-SHA" export TLS_INTERPOSER_OPTIONS=debug,logfile
to your configuration list. This will also be the default starting in TLS Interposer 1.3.0 (and is already in the current master git repository).