Jira (PUP-2177) PR (2494) Insecure shipped Cipher settings in Passenger example config

[Joshua Cooper (JIRA)]

Title: Message Title

Joshua Cooper commented on an issue   Re: PR (2494) Insecure shipped Cipher settings in Passenger example config Still working on a proper fix. It isn't as easy as it seems with a ton of OpenSSL versions and a ciphersuite this big though. I'll keep you posted. Great, we appreciate your help with that. Not sure what you mean by "AES-256 should be possible" - I think ephemeral Diffie-Hellman is the issue, right? AES-128 is more than enough in any case, of course AES-256 should be prefered if it's possible to use for both server and client. I don't think AES-128 is selected just because DHE is missing, why should that be the case? From https://github.com/puppetlabs/puppet/pull/2494#issuecomment-41346706, when using the old configuration, I see DHE-RSA-AES256-SHA. With the new configuration, I see AES128-SHA. So both client and server openssl versions support DHE, it's just that the new cipher string causes DHE to be disabled. Combine that with what you said: I have found another error that we made while changing the CipherSuite spec in this thread: "AES256-SHA" was removed. I believe the new cipher string disables all DHE ciphers, and it falls back to AES128-SHA since that's the last cipher in the string: + SSLCipherSuite ...:ES256-SHA:AES128-SHA If you change that to: + SSLCipherSuite ...:ES256-SHA:AES256-SHA:AES128-SHA Then they do negotiate: Protocol : TLSv1 Cipher : AES256-SHA As for 128 vs 256, yeah, we generate 4096 RSA keys which is "equivalent" to 128-bit symmetric keys, so going to 256 doesn't help the weakest link. That said, I agree, if we can do 256, we should, assuming it does not cause performance problems. So how about we append AES256-SHA, but before AES128-SHA? Can you update the PR (you'll want to force push to your branch), reopen the PR, and I will merge it. Sound good? Add Comment   Puppet / PUP-2177 PR (2494) Insecure shipped Cipher settings in Passenger example config https://github.com/puppetlabs/puppet/pull/2494 This message was sent by Atlassian JIRA (v6.1.4#6159-sha1:44eaede) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.