....I didn't know about your problem, but it is so similar that it must arise at the same time. In conclusion, I don't wonder anymore about it, because it seems to be the expected behavior...
These changes can be made by Plesk in other locations as well as those that have already been mentioned. You would normally expect any customised cipher / protocol values to remain precedent over any default Plesk values, but...
Example: When renewing a Multi-Domain *Wildcard Plesk Host Domain SSL Certificate, but, manually and without using the Plesk Let's Encrypt Extention (as the present version of the extention doesn't support that specific type of Let's Encrypt Certificate renewal yet). You need to double check afterwards and where appropriate, overwrite any Plesk default cipher / protocol values (again!) with any of the previous modifications that had been made.
As you say
@Servus it's only the cipher and protocol details, not other items. After the certificate renewal process example mentioned above (assuming, that customised cipher and protocol changes had previously been made) the the locations would be: Postfix:
main.cf file Dovecot:
11-plesk-security-ssl.conf etc.
We're not sure that this is actually a bug
@DieterWerner as it's just Plesk applying their own default security values regardless, to specific files they 'control'. It's a bit more like, a "...be aware" piece of information really, because if you are aware, then it's easy to check and amend after any Plesk (or Plesk controlled) updates.
Off topic for a moment
@DieterWerner For security reasons, TLSv1.0 isn't actually supported by nearly everybody now and even TLSv1.1 is pretty antiquated. In a "best setup / perfect world scenario" you would be completely TLSv1.3 together with TLSv1.2 as a backstop / legacy support, but only the Plesk Onyx 17.9 Preview Release actually supports TLSv1.3 by default at present, so many people (us included) are using TLSv1.2 only whilst waiting.
We don't use it, but whoever is responsible at Plesk for configuring the DrWeb service to still require TLSv1.0 needs to have a word with themselves and very quickly, play catchup / issue a upgraded release for those that do use it. There's a lot of other things too, that are currently well out of date in Plesk
Fingers crossed, Plesk will "update" these soon for everyone's benefit and peace of mind.
Facebook
Twitter
