BBlack has submitted this change and it was merged.
Change subject: Rank all ECDHE > all DHE for "mid" level suites
......................................................................
Rank all ECDHE > all DHE for "mid" level suites
Some clients support both ECDHE and DHE < 1024-bit.
The current cipher suite breaks them, since we use
DHE 2048-bit. ECDHE is also better in performance.
So I suggest we prefer ECDHE+non-AEAD over DHE+AEAD.
As BBlack suggested, if a client supports GCM mode
of operation, it is unlikely to limit DHE to 1024bit.
So "strong" list is unchanged.
Bug: T105455
Change-Id: Ie9f36e47a0bc03660703e2a64de39042cfe87691
---
M modules/wmflib/lib/puppet/parser/functions/ssl_ciphersuite.rb
1 file changed, 3 insertions(+), 3 deletions(-)
Approvals:
BBlack: Verified; Looks good to me, approved
diff --git a/modules/wmflib/lib/puppet/parser/functions/ssl_ciphersuite.rb
b/modules/wmflib/lib/puppet/parser/functions/ssl_ciphersuite.rb
index f85788f..a33f753 100644
--- a/modules/wmflib/lib/puppet/parser/functions/ssl_ciphersuite.rb
+++ b/modules/wmflib/lib/puppet/parser/functions/ssl_ciphersuite.rb
@@ -89,15 +89,15 @@
'mid' => [
'ECDHE-ECDSA-AES128-SHA256',
'ECDHE-RSA-AES128-SHA256',
- 'DHE-RSA-AES128-SHA256',
'ECDHE-ECDSA-AES128-SHA',
'ECDHE-RSA-AES128-SHA',
- 'DHE-RSA-AES128-SHA',
'ECDHE-ECDSA-AES256-SHA384',
'ECDHE-RSA-AES256-SHA384',
- 'DHE-RSA-AES256-SHA256',
'ECDHE-ECDSA-AES256-SHA',
'ECDHE-RSA-AES256-SHA',
+ 'DHE-RSA-AES128-SHA256',
+ 'DHE-RSA-AES128-SHA',
+ 'DHE-RSA-AES256-SHA256',
'DHE-RSA-AES256-SHA',
'DHE-RSA-CAMELLIA128-SHA',
'DHE-RSA-CAMELLIA256-SHA',
--
To view, visit https://gerrit.wikimedia.org/r/224232
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: Ie9f36e47a0bc03660703e2a64de39042cfe87691
Gerrit-PatchSet: 5
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Chmarkine <[email protected]>
Gerrit-Reviewer: BBlack <[email protected]>
Gerrit-Reviewer: Brion VIBBER <[email protected]>
Gerrit-Reviewer: Chmarkine <[email protected]>
Gerrit-Reviewer: JanZerebecki <[email protected]>
Gerrit-Reviewer: Mark Bergsma <[email protected]>
Gerrit-Reviewer: jenkins-bot <>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
