For Zimbra 8.5 and newer

Execute as the zimbra user:

zmprov mcf zimbraMtaSmtpdTlsCiphers high
zmprov mcf zimbraMtaSmtpdTlsProtocols ‘!SSLv2,!SSLv3’
zmprov mcf zimbraMtaSmtpdTlsMandatoryCiphers high
zmprov mcf zimbraMtaSmtpdTlsExcludeCiphers ‘aNULL,MD5,DES’

Within 2 minutes, zmconfigd will update postfix for you, and the system will be PCI compliant.

To check the current settings, execute as the zimbra user:

zmprov gcf zimbraMtaSmtpdTlsCiphers
zmprov gcf zimbraMtaSmtpdTlsProtocols
zmprov gcf zimbraMtaSmtpdTlsMandatoryCiphers
zmprov gcf zimbraMtaSmtpdTlsExcludeCiphers

See also: Disable TLS 1.0 and 1.1 In Zimbra Proxy