Am 30.01.2014 13:30, schrieb Uri Shachar: > On Thu, 30 Jan 2014 12:48:33 +0100 Reindl Harald wrote: >> somehow ATS does not listen on 8443 >> with out the "ssl=" it does but not accept https connections >> >> what i don't understand is why i need "server.cert.path" and >> "server.private_key.path" >> at all additionally to "ssl_multicert.config" and which cert this should be >> in >> production, but that's a leter problem after it accepts ssl-connections at >> all >> >> /etc/trafficserver/records.config: >> CONFIG proxy.config.http.server_ports STRING 8080,ssl=8443 > > Your config is wrong - try: > CONFIG proxy.config.http.server_ports STRING 8080 8443:ssl > > Also, proxy.config.ssl.cert.path and proxy.config.ssl.server.private_key.path > should be paths, not specific certs: > # This is the path that SSL certificates files are relative to. Certificate > # names specified in ssl_multicert.config will be located relative to this > path. > CONFIG proxy.config.ssl.server.cert.path STRING config > # If any private key is not contained in the certificate file, you must > # fill in the private key path. Private key names specified in > # ssl_multicert.config will be located relative to this path. > CONFIG proxy.config.ssl.server.private_key.path STRING config
indeed - thanks for helping the blind man
"CONFIG proxy.config.http.server_ports STRING 8080 8443:ssl" does the trick
one remaining issue currently is that DHE/ECDHE seems not to be supported
while httpd/openssl with the same environment do
[harry@rh:~]$ sslscan rhsoft.testserver.rhsoft.net:8443 | grep Accepted
Accepted TLSv1 256 bits AES256-SHA
Accepted TLSv1 256 bits CAMELLIA256-SHA
Accepted TLSv1 168 bits DES-CBC3-SHA
Accepted TLSv1 128 bits AES128-SHA
Accepted TLSv1 128 bits CAMELLIA128-SHA
Accepted TLS11 256 bits AES256-SHA
Accepted TLS11 256 bits CAMELLIA256-SHA
Accepted TLS11 168 bits DES-CBC3-SHA
Accepted TLS11 128 bits AES128-SHA
Accepted TLS11 128 bits CAMELLIA128-SHA
Accepted TLS12 256 bits AES256-GCM-SHA384
Accepted TLS12 256 bits AES256-SHA
Accepted TLS12 256 bits CAMELLIA256-SHA
Accepted TLS12 168 bits DES-CBC3-SHA
Accepted TLS12 128 bits AES128-GCM-SHA256
Accepted TLS12 128 bits AES128-SHA
Accepted TLS12 128 bits CAMELLIA128-SHA
_________________________________________________
CONFIG proxy.config.ssl.server.cipher_suite STRING
ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-RSA-CAMELLIA256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA:CAMELLIA128-SHA:CAMELLIA256-SHA:ECDHE-RSA-DES-CBC3-SHA:DES-CBC3-SHA:!LOW:!MEDIUM
_________________________________________________
that cipher suite should result in the following server-preferred order
verified with https://www.ssllabs.com/ssltest/index.html and httpd
Cipher Suites (SSL 3+ suites in server-preferred order, then SSL 2 suites where
used)
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f) ECDH 256 bits (eq. 3072 bits
RSA) FS
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030) ECDH 256 bits (eq. 3072 bits
RSA) FS
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x9e) DH 3072 bits (p: 512, g: 1, Ys: 512)
FS
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x9f) DH 3072 bits (p: 512, g: 1, Ys: 512)
FS
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027) ECDH 256 bits (eq. 3072 bits
RSA) FS
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028) ECDH 256 bits (eq. 3072 bits
RSA) FS
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) ECDH 256 bits (eq. 3072 bits RSA)
FS
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) ECDH 256 bits (eq. 3072 bits RSA)
FS
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (0x67) DH 3072 bits (p: 512, g: 1, Ys: 512)
FS
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (0x6b) DH 3072 bits (p: 512, g: 1, Ys: 512)
FS
TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x33) DH 3072 bits (p: 512, g: 1, Ys: 512)
FS
TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x39) DH 3072 bits (p: 512, g: 1, Ys: 512)
FS
TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA (0x45) DH 3072 bits (p: 512, g: 1, Ys:
512) FS
TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA (0x88) DH 3072 bits (p: 512, g: 1, Ys:
512) FS
TLS_RSA_WITH_AES_128_GCM_SHA256 (0x9c)
TLS_RSA_WITH_AES_256_GCM_SHA384 (0x9d)
TLS_RSA_WITH_AES_128_CBC_SHA (0x2f)
TLS_RSA_WITH_AES_256_CBC_SHA (0x35)
TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (0x41)
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (0x84)
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (0xc012) ECDH 256 bits (eq. 3072 bits RSA)
FS
TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa)
signature.asc
Description: OpenPGP digital signature
