Software / code / prosody
Changeset
5907:9586979058b8
certmanager: Update default cipher string to prefer forward-secrecy over cipher strength and to disable triple-DES (weaker and much slower than AES)
| author | Matthew Wild <mwild1@gmail.com> |
|---|---|
| date | Sun, 10 Nov 2013 18:46:48 +0000 |
| parents | 5906:071a7e461ae7 |
| children | 5908:081a91507e4f 5915:e6fed1d80116 |
| files | core/certmanager.lua |
| diffstat | 1 files changed, 1 insertions(+), 1 deletions(-) [+] |
line wrap: on
line diff
--- a/core/certmanager.lua Sun Nov 10 16:43:10 2013 +0000 +++ b/core/certmanager.lua Sun Nov 10 18:46:48 2013 +0000 @@ -70,7 +70,7 @@ options = user_ssl_config.options or default_options; depth = user_ssl_config.depth; curve = user_ssl_config.curve or "secp384r1"; - ciphers = user_ssl_config.ciphers or "HIGH:!DSS:!aNULL@STRENGTH"; + ciphers = user_ssl_config.ciphers or "HIGH+kEDH:HIGH+kEECDH:HIGH+kRSA:!DSS:!3DES:!aNULL"; dhparam = user_ssl_config.dhparam; };
