2 Commits

Author	SHA1	Message	Date
William Lallemand	501d9fdb86	MEDIUM: ssl: allow to change the OpenSSL security level from global section ... The new "ssl-security-level" option allows one to change the OpenSSL security level without having to change the openssl.cnf global file of your distribution. This directives applies on every SSL_CTX context. People sometimes change their security level directly in the ciphers directive, however there are some cases when the security level change is not applied in the right order (for example when applying a DH param). Before this patch, it was to possible to trick by using a specific openssl.cnf file and start haproxy this way: OPENSSL_CONF=./openssl.cnf ./haproxy -f bug-2468.cfg Values for the security level can be found there: https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set_security_level.html This was discussed in github issue #2468.	2024-03-12 17:37:11 +01:00
William Lallemand	83a0cde207	REORG: ssl: move 'generate-certificates' code to ssl_gencert.c ... A lot of code specific to the 'generate-certificates' option was left in ssl_sock.c. Move the code to 'ssl_gencert.c' and 'ssl_gencert.h'	2024-01-12 17:40:42 +01:00