3 files changed, 8 insertions, 6 deletions
diff --git a/test/confs/2024 b/test/confs/2024
index 64502d56b..ea3b28206 100644
--- a/test/confs/2024
+++ b/test/confs/2024
@@ -22,4 +22,6 @@ tls_verify_hosts = HOSTIPV4
 #tls_verify_certificates = TVC
 tls_verify_certificates = CERT
 
+# so we can decode in wireshark
+tls_require_ciphers = NORMAL:-KX-ALL:+RSA
 # End
diff --git a/test/confs/2025 b/test/confs/2025
index feaa815a1..fdf1e0405 100644
--- a/test/confs/2025
+++ b/test/confs/2025
@@ -17,8 +17,7 @@ queue_run_in_order
 
 tls_advertise_hosts = *
 
-tls_require_ciphers = ${if eq{$sender_host_address}{HOSTIPV4}\
-                      {NONE}{SECURE256}}
+tls_require_ciphers = NORMAL:-VERS-ALL:+VERS-TLS1.2:-MAC-ALL:+SHA256
 
 # Set certificate only if server
 
@@ -45,9 +44,10 @@ send_to_server:
   driver = smtp
   allow_localhost
   hosts = HOSTIPV4 : 127.0.0.1
-  hosts_require_tls = HOSTIPV4
   port = PORT_D
-
+  hosts_require_tls = HOSTIPV4
+  tls_require_ciphers = NORMAL:-VERS-ALL:+VERS-TLS1.2:-MAC-ALL:+SHA\
+	 ${if eq{$host}{HOSTIPV4} {384} {256} }
 
 # ----- Retry -----
 
diff --git a/test/confs/5821 b/test/confs/5821
index 9b73181a9..86ddbdedd 100644
--- a/test/confs/5821
+++ b/test/confs/5821
@@ -23,7 +23,7 @@ tls_certificate = ${if eq {SERVER}{server} {CDIR2/fullchain.pem}fail}
 tls_privatekey =  ${if eq {SERVER}{server} {CDIR2/server1.example.com.unlocked.key}fail}
 
 # Permit two specific ciphers
-tls_require_ciphers = NONE:+VERS-TLS-ALL:+MAC-ALL:+RSA:+AES-128-CBC:+CAMELLIA-256-GCM:+SIGN-ALL:+COMP-NULL
+tls_require_ciphers = NORMAL:-KX-ALL:+RSA:-CIPHER-ALL:+AES-128-CBC:+CAMELLIA-256-GCM
 
 # ----- Routers -----
 begin routers
@@ -52,7 +52,7 @@ send_to_server:
   tls_verify_certificates =	CDIR2/ca_chain.pem
 
   # Some commonly-available cipher, we hope
-  tls_require_ciphers =		NONE:+VERS-TLS-ALL:+MAC-ALL:+RSA:+AES-128-CBC:+SIGN-ALL:+COMP-NULL
+  tls_require_ciphers =		NORMAL:-CIPHER-ALL:+AES-128-CBC
   dane_require_tls_ciphers =	OPT
 
 # ----- Retry -----