From 3d8365c595d1b88fe3fd7e6c14264c4d984848f9 Mon Sep 17 00:00:00 2001 From: Ossi Salmi Date: Fri, 19 Dec 2014 01:11:08 +0200 Subject: [PATCH] ssl: Use Mozilla's Intermediate compatibility ciphersuite --- ssl/manifests/ciphersuites.pp | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/ssl/manifests/ciphersuites.pp b/ssl/manifests/ciphersuites.pp index 75db2a2..be407c6 100644 --- a/ssl/manifests/ciphersuites.pp +++ b/ssl/manifests/ciphersuites.pp @@ -8,15 +8,17 @@ # Mozilla's recommended cipersuite list (document version 2.5.1) # 2014-07-21, osalmi # Update to Version 3.1 +# 2014-12-19, osalmi +# Use the Intermediate compatibility configuration (Version 3.4) # class ssl::ciphersuites { # - # Mozilla (document version 3.1) + # Mozilla (document version 3.4) # # Ref: https://wiki.mozilla.org/Security/Server_Side_TLS#Backward_Compatible_Ciphersuite # - $mozilla_ciphersuites = 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:AES:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK' + $mozilla_ciphersuites = 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA' # # Default ciphersuites