With PCI Compliance enabled, Horde Webmail stops working

[Rupert]

TITLE:

With PCI Compliance enabled, Horde Webmail stops working​

PRODUCT, VERSION, OPERATING SYSTEM, ARCHITECTURE:

Plesk Onyx 17.5, CentOS 7, PHP 5.4, Horde 5.2.13​

PROBLEM DESCRIPTION:

Enabing PCI compliance forbids the use of TLSv1 and older protocols such as SSL in, among others, Dovecot and Postfix. At the same time, the most recent versions of PHP and Horde used by Plesk do not support modern TLS protocols, failing to establish any connection.

For reference, Horde uses the operating system vendor's PHP version (5.4) and not the Plesk-provided PHP version (5.6), which may be a cause of this problem (I have not been able to verify).​

STEPS TO REPRODUCE:

1. Install Plesk from Scratch
2. Enable Horde webmail
3. Enable PCI compliance by running ``/usr/local/psa/admin/bin/pci_compliance_resolver --enable all``
4. Attempt to login to webmail

ACTUAL RESULT:

Unable to login to webmail (which means IMAP cannot be connected).

After running ``/usr/local/psa/admin/bin/pci_compliance_resolver --disable dovecot``, login to receive emails is possible.
However, it is impossible to send any emails ("Could not open secure TLS connection to the server").
After running ``/usr/local/psa/admin/bin/pci_compliance_resolver --disable postfix``, Horde is able to receive and send emails.​

EXPECTED RESULT:

Plesk runs a PCI compliant system with webmail.​

ANY ADDITIONAL INFORMATION:

I attempted to submit this error report through proper channels, but for some reason it is not possible to submit an error report when a license is purchased through a reseller.​

YOUR EXPECTATIONS FROM PLESK SERVICE TEAM:

Confirm bug​

 

[B_P]

Another issue with enabling PCI compliance is that Dr. Web stops working if used for less then 10 mail addresses (when no license is required). This is already filed as bug PPPM-5740 but not publicly documented.