Changeset 8d0efdc in mod_gnutls for src

Timestamp:

Jun 18, 2020, 4:57:32 PM (7 months ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

asyncio, master

Children:

9a26df9

Parents:

8f000b7

Message:

Disable session tickets by default

After learning that the GnuTLS key "rotation" scheme never actually
changes the primary key I'm disabling session tickets by default,
because I cannot ensure everyone will reload their servers to replace
the keys. I hope to eventually implement a real key rotation and
enable tickets by default again.

File:

• src/gnutls_hooks.c (modified) (1 diff)

src/gnutls_hooks.c

@@ -659 +659 @@
             sc->enabled = GNUTLS_ENABLED_FALSE;
         if (sc->tickets == GNUTLS_ENABLED_UNSET)
-        {
-            /* GnuTLS 3.6.4 introduced automatic master key rotation */
-            if (gnutls_check_version_numeric(3, 6, 4))
-                sc->tickets = GNUTLS_ENABLED_TRUE;
-            else
-                sc->tickets = GNUTLS_ENABLED_FALSE;
-        }
+            sc->tickets = GNUTLS_ENABLED_FALSE;
         if (sc->export_certificates_size < 0)
             sc->export_certificates_size = 0;