search

headcounter / deployment

NixOps deployment
Other
32 stars 5 forks source link

Generate and patch DH params into OpenSSL #23

Closed aszlig closed 8 years ago

aszlig commented 8 years ago

Currently we only have 1024bit DH params enabled, which is a "bit" weak, so while we also offer ECDHE key exchange and would like to drop DHE cipher suite we really can't do that at the moment, because some clients do not support ECDHE key exchange.

So, in short: Let's provide reasonable secure DH params.

And let's do it by patching them into OpenSSL directly so we can take advantage of that on every server component that's using OpenSSL... at least if that's possible to easily patch it in :-)

aszlig commented 8 years ago

Fixed by a1957e3b956fd13863952a668ec1f9004d5f8911.