Additionally I found this MF developers site that explains which ciphersuites are enabled by default (I think that means when I do not enter anything in the SMG):

https://www.microfocus.com/documentation/enterprise-developer/ed60/ES-WIN/GUID-298AB08F-220D-42FD-AFEF-10AA22E94F94.html

TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256

The content of this setting is passed verbatim into the OpenSSL API SSL_CTX_set_ciphersuites, so yes, the OpenSSL docs are your reference for this value.

With regards to including, adding, omitting settings, the same applies.  SMG does no processing of the strings provided, so if you have specific requirements for how the SSL ciphers are handled, you can control it via this input value.

If this field is left blank, the default SSL cipher suite is used (as defined by the OpenSSL API). 

If you put this info into the 1.2 setting, that'll be passed into the SSL API SSL_CTX_set_cipher_list, which won't recognize the values.

The SMTP log info prints the internal settings of the SSL API connection info.  How the ciphers are chosen are a matter for the OpenSSL libraries.  You'd need to reach out to the OpenSSL community to understand how that works.

Hope that helps.

Yeah. I understand. But first the documentation of the SMG is not up-to-date and second the openssl community and manuals are not very easy to understand for everyone. At least OpenText should add a small guideline on how to use these features in SMG and a best-practice. Implementing something creates also a responsability to clarify how to use it.

I already created different cases on the cipher list for TLS 1.2 but no one at OpenText does any recommendation on that. Also referring to the OpenSSL documentation. Problems with the ciphers are e.a. cipher order (there is no preference, like in Apache), excluding some ciphers and the consequences of that (e.g. !DH).

I guess the best we can do is to wait until TLS 1.2 becomes obsolete and we only have to use TLS 1.3. Then a lot of weak ciphers are dropped.