Directive "starttls" should not be on when use "ssl"

[zhoushulin1992@…]

Since "starttls" and "ssl" are conflict, it is better to note it in the doc of starttls as a reminder in ​https://nginx.org/en/docs/mail/ngx_mail_ssl_module.html#starttls, in case of negligence.

[Maxim Dounin]

Thank you for your suggestion. This "ssl" directive was made obsolete in nginx 1.15.0, and it certainly does not make sense to document any conflicts with it.

[zhoushulin1992@…]

Replying to Maxim Dounin:

Thank you for your suggestion. This "ssl" directive was made obsolete in nginx 1.15.0, and it certainly does not make sense to document any conflicts with it.

Could the directive "starttls" used with parameter "ssl" in directive "listen"?

[Maxim Dounin]

Yes. There can be more than one listening socket in the server block, including SSL and non-SSL listening sockets, for example:

server {
    listen 25;
    listen 465 ssl;
    starttls only;
}

So there is no direct conflict, and configurations with SSL listening sockets and starttls are considered valid. In some configurations with only SSL listening sockets starttls might be meaningless, yet this is not something nginx currently checks (and unlikely will, since using starttls only; at the mail level looks like a valid use case even if some servers only have SSL listening sockets configured).