diff options
| author | Kasei <cnsdwpc@gmail.com> | 2019-11-06 15:09:29 +0800 |
|---|---|---|
| committer | Unknwon <u@gogs.io> | 2019-11-05 23:09:29 -0800 |
| commit | dbc66d0405a83bdef9a12ca00399ede7cb947946 (patch) | |
| tree | d421e4c6484bd385d9ecbcf60fde3b7084c049f9 /internal | |
| parent | 9578a3cc31c8543911bf32e3d1c03f9e29046ffa (diff) | |
tls: update default CurvePreferences and CipherSuites (#5850)
* Enable X25519 curve and reorder curve list to improve key exchange performance
* Enable ECDSA ciphers for EC certs
* Enable CHACHA20_POLY1305 ciphers
* Disable RSA key exchange algorithm which don't provide PFS
* Disable non-AEAD ciphers
Signed-off-by: Kasei Wang <kasei@kasei.im>
Diffstat (limited to 'internal')
| -rw-r--r-- | internal/cmd/web.go | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/internal/cmd/web.go b/internal/cmd/web.go index f08854a4..306070d8 100644 --- a/internal/cmd/web.go +++ b/internal/cmd/web.go @@ -719,13 +719,15 @@ func runWeb(c *cli.Context) error { } server := &http.Server{Addr: listenAddr, TLSConfig: &tls.Config{ MinVersion: tlsMinVersion, - CurvePreferences: []tls.CurveID{tls.CurveP521, tls.CurveP384, tls.CurveP256}, + CurvePreferences: []tls.CurveID{tls.X25519, tls.CurveP256, tls.CurveP384, tls.CurveP521}, PreferServerCipherSuites: true, CipherSuites: []uint16{ + tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, - tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, // Required for HTTP/2 support. - tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, - tls.TLS_RSA_WITH_AES_256_CBC_SHA, + tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, + tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, + tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, + tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, }, }, Handler: m} err = server.ListenAndServeTLS(setting.CertFile, setting.KeyFile) |