Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Update SSL cipher configuration and give options to switch #1346

Closed
mrrobot47 opened this issue Dec 12, 2018 · 0 comments
Closed

Update SSL cipher configuration and give options to switch #1346

mrrobot47 opened this issue Dec 12, 2018 · 0 comments
Assignees

Comments

@mrrobot47
Copy link
Member

mrrobot47 commented Dec 12, 2018

The default SSL cipher configuration till now on EasyEngine is based on the Mozilla intermediate profile which provided compatibility with clients back to Firefox 1, Chrome 1, IE 7, Opera 5, Safari 1, Windows XP IE8, Android 2.3, Java 7. This configuration also enabled HSTS, PFS, OCSP stapling and SSL session caches. Currently, TLS 1.0, 1.1 and 1.2 are supported in it.

As, TLS 1.0 is deprecated and it reached its end of life on June 30, 2018.

It is time to switch to the default SSL cipher configuration to the: Mozilla modern profile. This profile is compatible with clients back to Firefox 27, Chrome 30, IE 11 on Windows 7, Edge, Opera 17, Safari 9, Android 5.0, and Java 8.

Apart from switching to Mozilla modern profile as default, need to add config option to switch to all the supported policies here.

Thus after implementation, ee config set ssl-policy <valid-policy> can be used to set desired policy.

Where <valid-policy> from here include:
Mozilla-Old, Mozilla-Intermediate, Mozilla-Modern, AWS-TLS-1-2-2017-01, AWS-TLS-1-1-2017-01, AWS-2016-08, AWS-2015-05, AWS-2015-03 and AWS-2015-02.

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant