From 4d26d4cb157143e7a9e4a0418fff9d8841cc9928 Mon Sep 17 00:00:00 2001 From: Kim Alvefur Date: Sun, 18 Jul 2021 22:46:57 +0200 Subject: core.certmanager: Support 'use_dane' setting to enable DANE support Removes the need to enable DANE with two separate settings. Previously you had to also set `ssl = { dane = true }` to activate DANE support in LuaSec and OpenSSL. --- core/certmanager.lua | 2 ++ 1 file changed, 2 insertions(+) (limited to 'core') diff --git a/core/certmanager.lua b/core/certmanager.lua index 753eb4d5..7c7fc150 100644 --- a/core/certmanager.lua +++ b/core/certmanager.lua @@ -244,6 +244,7 @@ local core_defaults = { "!3DES", -- 3DES - slow and of questionable security "!aNULL", -- Ciphers that does not authenticate the connection }; + dane = configmanager.get("*", "use_dane"); } if luasec_has.curves then @@ -360,6 +361,7 @@ local function reload_ssl_config() if luasec_has.options.no_compression then core_defaults.options.no_compression = configmanager.get("*", "ssl_compression") ~= true; end + core_defaults.dane = configmanager.get("*", "use_dane") or false; cert_index = index_certs(resolve_path(config_path, global_certificates)); end -- cgit v1.2.3