[dev.icinga.com #11290] ApiListener: Force server's preferred cipher

[icinga-migration]

This issue has been migrated from Redmine: https://dev.icinga.com/issues/11290

Created by tobiasvdk on 2016-03-03 12:55:29 +00:00

Assignee: tobiasvdk
Status: Resolved (closed on 2016-06-16 08:21:21 +00:00)
Target Version: 2.5.0
Last Update: 2016-06-16 08:21:21 +00:00 (in Redmine)

Backport?: Not yet backported
Include in Changelog: 1

---

Enable SSL_OP_CIPHER_SERVER_PREFERENCE to use the strongest cipher suite the client offers:

When choosing a cipher, use the server's preferences instead of the client preferences.
When not set, the SSL server will always follow the clients preferences.
When set, the SSL/TLS server will choose following its own preferences.

Changesets

2016-03-04 07:14:03 +00:00 by (unknown) 0d06422

Use the server's preferred cipher for the API connection

When using SSL_OP_CIPHER_SERVER_PREFERENCE the server's preferred cipher
is used instead of the client preference, see
https://www.openssl.org/docs/manmaster/ssl/SSL_CTX_set_options.html

refs #11290

2016-03-04 13:57:06 +00:00 by (unknown) ce30629

Use the server's preferred cipher for the API connection

When using SSL_OP_CIPHER_SERVER_PREFERENCE the server's preferred cipher
is used instead of the client preference, see
https://www.openssl.org/docs/manmaster/ssl/SSL_CTX_set_options.html

fixes #11290

---

Relations:

• relates #11290

[icinga-migration]

Updated by tobiasvdk on 2016-03-03 12:55:43 +00:00

• Relates set to 11063

[icinga-migration]

Updated by Anonymous on 2016-03-04 14:40:04 +00:00

• Status changed from Assigned to Resolved
• Done % changed from 0 to 100

Applied in changeset ce30629.

[icinga-migration]

Updated by mfriedrich on 2016-03-04 14:46:28 +00:00

• Status changed from Resolved to Assigned

Before pushing to git master, please let us know about such changes - especially regarding compatibility with all platforms to be tested in terms of openssl.

Kind regards,
Michael

[icinga-migration]

Updated by mfriedrich on 2016-03-18 10:53:42 +00:00

• Target Version set to 2.5.0

Setting the target version so that we do not forget about a final review and tests for that change.

[icinga-migration]

Updated by mfriedrich on 2016-06-16 08:21:21 +00:00

• Status changed from Assigned to Resolved