mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-09-22 06:11:32 +02:00
Code Issues Projects Releases Wiki Activity

MEDIUM: ssl: use TLSv1.2 as the minimum default on bind lines

Browse Source 
Since HAProxy 1.8, the TLS default minimum version was set to TLSv1.0 to
avoid using the deprecated SSLv3.0. Since then, the standard changed and
the recommended TLS version is now TLSv1.2.

This patch changes the minimum default version to TLSv1.2 on bind lines.
If you need to use prior TLS version, this is still possible by
using the ssl-min-ver keyword.
This commit is contained in:
William Lallemand 2020-05-29 08:54:33 +02:00 committed by William Lallemand
parent 56192cc60b
commit 2f44a59c7f
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/ssl_sock.c
View File

@ -3663,9 +3663,9 @@ ssl_sock_initial_ctx(struct bind_conf *bind_conf)
min = conf_ssl_methods->min; min = conf_ssl_methods->min;
max = conf_ssl_methods->max; max = conf_ssl_methods->max;
/* start with TLSv10 to remove SSLv3 per default */ /* start with TLSv12 to remove SSLv3,TLSv10,TLSv11 per default */
if (!min && (!max || max >= CONF_TLSV10)) if (!min && (!max || max >= CONF_TLSV12))
min = CONF_TLSV10; min = CONF_TLSV12;
/* Real min and max should be determinate with configuration and openssl's capabilities */ /* Real min and max should be determinate with configuration and openssl's capabilities */
if (min) if (min)
flags |= (methodVersions[min].flag - 1); flags |= (methodVersions[min].flag - 1);