Re: A few thoughts on Haproxy and weakdh/logjam

2015-05-23 Thread Mark Janssen
Generating dhparams can result in wildly different runtimes... Just running a dhparm 1024 here resulted in times between 1.3 and 12 second... I've generated a bunch of 2048 dhparams, which took between 1 and 30 minutes depends on luck, finding the right set of good primes. But generating 1024

Re: A few thoughts on Haproxy and weakdh/logjam

2015-05-23 Thread Willy Tarreau
Hi Rémi, On Fri, May 22, 2015 at 10:53:08AM +0200, Remi Gacogne wrote: Otherwise it makes no sense, sorry about that. ah ? Well, with the previous command I was basically saying if a DH 2048-bit group is too much CPU-consuming for you, just use a 2048-bit group, which makes no sense

Re: Re: SSL custom dhparam problem

2015-05-23 Thread Willy Tarreau
On Fri, May 22, 2015 at 10:58:47AM +0200, Remi Gacogne wrote: On Fri, May 22, 2015 at 09:10:36AM +0200, Hervé Commowick wrote: As a temporary solution, i have decided to use a custom DH param for each bind, but anyway, this clearly need a fix :) Did you test Rémi's patch to confirm

LED Manufacturer

2015-05-23 Thread Antony Huang
Dear Sir/Madam, Hope this mail will bring your more luck . Ancolin is a Chinese company who ?can supply LED lamps(such as LED bulb¡¢LEDfluorescent¡¢LED power?supply¡¢LED controller etc.) Our website:www.ym-tech.com If you want to know more details of our goods,pls let us know. Tks Best

RE: SSL custom dhparam problem

2015-05-23 Thread Lukas Tribus
OK so now we need to find what to do in the end. From what I understood, just removing the lines was a test and is not viable because we'll always emit the warning, right ? Honestly, I'm opting for removing the DH fallback in haproxy altogether and simple always warn when the certificate (or a