Outlook TLS error: "None of the authentication methods supported by this client are supported by your server." – cPanel

Symptoms

When using older email clients, such as Microsoft Outlook 2013 and earlier, on older operating systems, such as Windows 7, You encounter an error similar to the following.

None of the authentication methods supported by this client are supported by your server.

Description

In Version 68 of cPanel, we introduced new SSL ciphers to increase the security of the mail server; this enables TLS 1.2 and disables older SSL/TLS protocols, such as SSL 3 TLS 1.0. Older operating systems and email clients that do not utilize newer security protocols will be affected by this change.

Please note that this is not a defect or an issue with cPanel, but an incompatibility with the outdated client software. Updating the client software to support TLS 1.2 will help maintain overall security.

Workaround

There are two options to address this issue.

Please note that the second option is not recommended and should only be used if the first option cannot be utilized.

Option 1: (RECOMMENDED)

To enable TLS 1.2 for Windows 7, you will need to patch your system to modify the registry. Be sure your system is fully updated through the update center, then download and install the patch from Microsoft's website.

Enable TLS 1.1 and 1.2 as the default secure protocols.

After the patch is installed, be sure to reboot your local computer to ensure the patch was applied. Once your system is back online, please try to connect to the cPanel server again.

Option 2: (NOT RECOMMENDED)

Log into WHM as the 'root' user.
Navigate to "Home / Service Configuration / Exim Configuration Manager."
Click the "Security" tab.
Set the "Allow weak SSL/TLS ciphers" option to "On."
Set the "Options for OpenSSL" option to the text box.
Enter the following in the textbox.
```
+no_sslv2 +no_sslv3
```
Set the "SSL/TLS Cipher Suite List" option to the textbox.

Enter the following in the textbox.

ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS

Click "Save" at the bottom of the page.
Navigate to "Home / Service Configuration / Mailserver Configuration."
Scroll down to the "SSL Cipher List" option.

Replace the text in the textbox with the following.

ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS

Change the "SSL Minimum Protocol" option to TLS1.
Scroll to the bottom of the page.
Click the "Save Changes" button.
If the server is a RHEL8-based server, such as AlmaLinux 8, the cryptographic policy must be set to LEGACY.
1. Access the server's command line as the 'root' user via SSH or "Terminal" in WHM.
2. Run the following command.
```
update-crypto-policies --set LEGACY
```
  Please note that the server must be rebooted for the policy change to be applied.