lighttpd
/
lighttpd1.4
2
0
Fork 0
Code Issues Releases Wiki Activity

[mod_openssl] default: ssl.cipher-list = "HIGH"

This commit is contained in:
Glenn Strauss 2019-02-19 03:38:24 -05:00
parent 3e200717cc
commit 8efa6a34f4
2 changed files with 17 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
doc/config/lighttpd.conf
View File

@ -422,55 +422,34 @@ server.upload-dirs = ( "/var/tmp" )
## ssl.engine = "enable"
## ssl.pemfile = "/path/to/server.pem"
##
## The HTTPS protocol does not allow you to use name-based virtual
## hosting with SSL. If you want to run multiple SSL servers with
## one lighttpd instance you must use IP-based virtual hosting: ::
##
## Mitigate CVE-2009-3555 by disabling client triggered renegotation
## This is enabled by default.
##
## IMPORTANT: this setting can only be used in the global scope.
## It does *not* work inside conditionals
##
# ssl.disable-client-renegotiation = "enable"
##
## $SERVER["socket"] == "10.0.0.1:443" {
## ssl.engine = "enable"
## ssl.pemfile = "/etc/ssl/private/www.example.com.pem"
## #
## # (Following SSL/TLS Deployment Best Practices 1.3 / 17 September 2013 from:
## # https://www.ssllabs.com/projects/best-practices/index.html)
## # - BEAST is considered mitigaed on client side now, and new weaknesses have been found in RC4,
## # so it is strongly advised to disable RC4 ciphers (HIGH doesn't include RC4)
## # - It is recommended to disable 3DES too (although disabling RC4 and 3DES breaks IE6+8 on Windows XP,
## # so you might want to support 3DES for now - just remove the '!3DES' parts below).
## # - The examples below prefer ciphersuites with "Forward Secrecy" (and ECDHE over DHE (alias EDH)), remove '+kEDH +kRSA'
## # if you don't want that.
## # - SRP and PSK are not supported anyway, excluding those ('!kSRP !kPSK') just keeps the list smaller (easier to review)
## # Check your cipher list with: openssl ciphers -v '...' (use single quotes as your shell won't like ! in double quotes)
## #
## # If you know you have RSA keys (standard), you can use:
## ssl.cipher-list = "aRSA+HIGH !3DES +kEDH +kRSA !kSRP !kPSK"
## # The more generic version (without the restriction to RSA keys) is
## # ssl.cipher-list = "HIGH !aNULL !3DES +kEDH +kRSA !kSRP !kPSK"
## #
## # Make the server prefer the order of the server side cipher suite instead of the client suite.
## # This option is enabled by default, but only used if ssl.cipher-list is set.
## #
## # ssl.honor-cipher-order = "enable"
## #
##
## # Check your cipher list with: openssl ciphers -v '...'
## # (use single quotes as your shell won't like ! in double quotes)
## #ssl.cipher-list = "HIGH" # default
##
## # (recommended to accept only TLSv1.2 and TLSv1.3)
## #ssl.openssl.ssl-conf-cmd = ("Protocol" => "-ALL, TLSv1.2, TLSv1.3")
##
## server.name = "www.example.com"
##
## server.document-root = "/srv/www/vhosts/example.com/www/"
## }
##
## If you have a .crt and a .key file, cat them together into a
## single PEM file:
## If you have a .crt and a .key file, specify both ssl.pemfile and ssl.privkey,
## or cat them together into a single PEM file:
## $ cat /etc/ssl/private/lighttpd.key /etc/ssl/certs/lighttpd.crt \
## > /etc/ssl/private/lighttpd.pem
##
#ssl.pemfile = "/etc/ssl/private/lighttpd.pem"
#
# or
#
#ssl.privkey = "/etc/ssl/private/privkey.pem"
#ssl.pemfile = "/etc/ssl/private/cert.pem"
##
## optionally pass the CA certificate here.

2
src/mod_openssl.c
View File

@ -1236,6 +1236,8 @@ SETDEFAULTS_FUNC(mod_openssl_set_defaults)
s->ssl_read_ahead = (0 == i)
? 0
: p->config_storage[0]->ssl_read_ahead;
if (0 == i)
buffer_copy_string_len(s->ssl_cipher_list, CONST_STR_LEN("HIGH"));
if (0 != i) {
buffer *b;
b = p->config_storage[0]->ssl_ca_crl_file;