mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-08-05 22:56:57 +02:00
Code Issues Projects Releases Wiki Activity

DOC: configuration: add details on prefer-client-ciphers

Browse Source 
prefer-client-ciphers does not work exactly the same way when used with
a dual algorithm stack (ECDSA + RSA). This patch details its behavior.

This patch must be backported in every maintained version.

Problem was discovered in #2988.
This commit is contained in:
William Lallemand 2025-06-25 14:41:45 +02:00
parent 4a298c6c5c
commit 370a8cea4a
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
doc/configuration.txt
View File

@ -16883,10 +16883,17 @@ prefer-client-ciphers
Use the client's preference when selecting the cipher suite, by default
the server's preference is enforced. This option is also available on
global statement "ssl-default-bind-options".
Note that with OpenSSL >= 1.1.1 ChaCha20-Poly1305 is reprioritized anyway
(without setting this option), if a ChaCha20-Poly1305 cipher is at the top of
the client cipher list.
When using a dual algorithms setup (RSA + ECDSA), the selection algorithm
will chose between RSA and ECDSA and will always prioritize ECDSA. Once the
right certificate is chosen, it will let the SSL library prioritize ciphers,
curves etc. Meaning this option can't be used to prioritize an RSA
certificate over an ECDSA one.
proto <name>
Forces the multiplexer's protocol to use for the incoming connections. It
must be compatible with the mode of the frontend (TCP or HTTP). It must also