Configuring TLS 1.3 and eliminating weak ciphers on Mac mini M2 macOS Sequoia

Question

Level 1

14 points

Configuring TLS 1.3 and eliminating weak ciphers on Mac mini M2 macOS Sequoia

I would like to know how to edit the TLS/SSL ciphers that my Mac mini M2 Sequoia 15.6 OS uses.

I have TLS 1.3 enabled using "defaults write /Library/Preferences/com.apple.networkd tcp_connect_enable_tls13 1" command line.

However whenever I sent an email using Apple Mail to my email server it only encrypts it using TLS 1.2 when it should use the strongest TLS 1.3 available.

It says I'm using:

LibreSSL 3.3.6

built on: date not available

platform: information not available

options: bn(64,64) rc4(ptr,int) des(idx,cisc,16,int) blowfish(idx)

compiler: information not available

OPENSSLDIR: "/private/etc/ssl"

I want to eliminate the following weak ciphers (see PNG attached).

What command lines do I use and how to I force MAC OS to use TLS 1.3 FIRST instead of TLS 1.2???

[Re-Titled by Moderator]

Original Title: HOW TO ELIMINATE WEAK TLS/SSL CIPHERS ON MACOS SEQUOIA

Mac mini, macOS 15.6

Posted on Jul 30, 2025 1:23 PM

Reply

Answer 1

MrHoffman

Level 10

153,037 points

Jul 30, 2025 1:57 PM in response to Chad954

The TLS negotiation usually picks the most secure option available on both ends, preferring TLSv1.2 or later with forward security. If you’re getting something weaker than that, check the mail server offer.

TLS security - Apple Support

Reply

Answer 2

MrHoffman

Level 10

153,037 points

Jul 30, 2025 3:44 PM in response to Chad954

That cipher ordering is not what I would expect.

I’d use this, or maybe modern:

https://ssl-config.mozilla.org/#server=postfix&version=3.9.0&config=intermediate&openssl=3.4.0&guideline=5.7

Reply

Answer 3

Jul 30, 2025 2:07 PM in response to Chad954

By default Mail with Mac OS 15 is going to use TLS 1.3 when available on the Mail Server.

The only time you would need to use that Terminal command is if you previously changed it. The handshake between your email server is going to negotiate the strongest encryption value available. Are you managing the email server yourself where it is running LibreSSL 3.3.6?

Reply

Answer 4

Chad954 Author

Level 1

14 points

Jul 30, 2025 2:28 PM in response to MrHoffman

I agree with you completely but that is NOT what's happening.

Here is what the mail server is offering - yes I run it myself. yes it is postfix and it is configured to use the server preferred cipher order which is:

TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256

Reply