aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMatthew Wild <mwild1@gmail.com>2013-11-10 18:46:48 +0000
committerMatthew Wild <mwild1@gmail.com>2013-11-10 18:46:48 +0000
commit07a71ad6aaaa44203609b5a7d22bea3e5bb40a4f (patch)
treeff971b23e03bf24b165220a41b8efb650821d7f3
parent948f787196c7433e404ed3e84943cceb829d3edc (diff)
downloadprosody-07a71ad6aaaa44203609b5a7d22bea3e5bb40a4f.tar.gz
prosody-07a71ad6aaaa44203609b5a7d22bea3e5bb40a4f.zip
certmanager: Update default cipher string to prefer forward-secrecy over cipher strength and to disable triple-DES (weaker and much slower than AES)
-rw-r--r--core/certmanager.lua2
1 files changed, 1 insertions, 1 deletions
diff --git a/core/certmanager.lua b/core/certmanager.lua
index 0503f40e..1a8da6a6 100644
--- a/core/certmanager.lua
+++ b/core/certmanager.lua
@@ -70,7 +70,7 @@ function create_context(host, mode, user_ssl_config)
options = user_ssl_config.options or default_options;
depth = user_ssl_config.depth;
curve = user_ssl_config.curve or "secp384r1";
- ciphers = user_ssl_config.ciphers or "HIGH:!DSS:!aNULL@STRENGTH";
+ ciphers = user_ssl_config.ciphers or "HIGH+kEDH:HIGH+kEECDH:HIGH+kRSA:!DSS:!3DES:!aNULL";
dhparam = user_ssl_config.dhparam;
};