Plesk 12.x / Linux :: Unable To Disable SSL V2 And V3 In Postfix And Courier

I am trying to secure my VPS and one thing noted in a recent scan was SSL v2 and v3 being supported for SMTP, POP3 and IMAP. So a check of ‘Disabling SSLv3 Support on Servers’ and the Postfix configuration settings suggest:

smtpd_tls_mandatory_exclude_ciphers = aNULL, MD5
# Preferred syntax with Postfix = 2.5:
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3​

This actually goes further than disabling SSLv2 and v3 and also excludes the use of NULL and MD5 ciphers.

The Postfix conf file, main.cf exists in two places on my VPS:

# find / -name main.cf
/usr/libexec/postfix/main.cf
/etc/postfix/main.cf​

Examining both only the copy in /etc/postfix/ is configured and at the end of this file I can find all the Plesk settings, including some RBLs I’ve defined via the UI. Hence I know this is the working config as of the two, it’s the only one actually configured. Hence I add the required commands to the config:

...
smtpd_tls_key_file = $smtpd_tls_cert_file
smtpd_tls_security_level = may
smtpd_use_tls = yes
smtp_tls_security_level = may

[Code] ....

I then go to the Plesk Tools & Settings > Services Management and restart:

SMTP Server (Postfix)
And for good measure:

Plesk milter (Postfix)

I then test whether SSLv2 is enabled:

# openssl s_client -connect x.x.x.x:25 -starttls smtp -ssl2​

Now what I should get back is an error as the attempt to connect with SSLv2 should fail as it's an excluded protocol, but instead what I get back is the Plesk cert and a connection:

# openssl s_client -connect x.x.x.x:25 -starttls smtp -ssl2
CONNECTED(00000003)
depth=0 C = US, ST = Virginia, L = Herndon, O = Parallels, OU = Parallels Panel, CN = Parallels Panel, emailAddress = info@parallels.com
verify error:num=18:self signed certificate
...​

Why? What do I need to do to have Postfix use the updated config and refuse an SSL2 connection?

I seem to have the same issue with Courier having made similar changes to the /etc/courier-imap/pop3d-ssl file:

# Iain 2014-12-12
# TLS_CIPHER_LIST="SSLv3:TLSv1:HIGH:!LOW:!MEDIUM:!EXP:!NULL:!aNULL@STRENGTH"
TLS_CIPHER_LIST="TLSv1:HIGH:MEDIUM:!LOW:!EXP:!NULL:!aNULL@STRENGTH"​

And /etc/courier-imap/imapd-ssl file:

# Iain 2014-12-12
# TLS_PROTOCOL=SSL23
TLS_PROTOCOL=TLS1​

actually, this should probably read:

# Iain 2014-12-12
# TLS_PROTOCOL=SSL23
TLS_PROTOCOL=TLS1, TLS1.1, TLD1.2​

Why am I unable to disable SSL v2 and v3 for SMTP/POP3/IMAP with Postfix and Courier?