Changeset facbb08 in mod_gnutls for doc

Timestamp:

Aug 12, 2020, 5:20:36 PM (3 years ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

asyncio, main, master

Children:

e080eef

Parents:

a66b5be

Message:

Update default priorities

This removes insecure and outdated things still included in the GnuTLS
priority set "NORMAL":

• Plain RSA key exchange, which does not provide forward secrecy

• TLS 1.0 and 1.1, which have a lot of known security issues (see ​https://tools.ietf.org/html/draft-ietf-tls-oldversions-deprecate-06)

Co-authored-by: Krista Karppinen <krista.celestia@…>

File:

• doc/mod_gnutls_manual.md (modified) (4 diffs)

doc/mod_gnutls_manual.md

@@ -206 +206 @@
 MACs and compression methods
 
-    GnuTLSPriorities NORMAL:+CIPHER_0:+CIPHER_1:...:+CIPHER_N
-
-Default: `NORMAL`\
+    GnuTLSPriorities NORMAL:+CIPHER_0:-CIPHER_1:...:+CIPHER_N
+
+Default: `NORMAL:-RSA:-VERS-TLS1.0:-VERS-TLS1.1`\
 Context: server config, virtual host
 
@@ -216 +216 @@
 [the GnuTLS documentation](https://gnutls.org/manual/html_node/Priority-Strings.html).
 
-For example, to disable TLS 1.0 use `NORMAL:-VERS-TLS1.0`.
+Plain RSA, without (EC-)DH, is disabled by default because it doesn't
+provide forward secrecy, TLS 1.0 and 1.1 have been deprecated as
+insecure for a long time and are now disabled in most modern web
+browsers.
 
 ### GnuTLSP11Module
@@ -515 +518 @@
 methods for proxy connections
 
-    GnuTLSProxyPriorities NORMAL:+CIPHER_0:+CIPHER_1:...:+CIPHER_N
-
-Default: `NORMAL`\
+    GnuTLSProxyPriorities NORMAL:+CIPHER_0:-CIPHER_1:...:+CIPHER_N
+
+Default: `NORMAL:-RSA:-VERS-TLS1.0:-VERS-TLS1.1`\
 Context: server config, virtual host
 
@@ -796 +799 @@
 ```
 
-This gives you an HTTPS site using the GnuTLS `NORMAL` set of
-ciphersuites. OCSP stapling will be enabled if the server certificate
-contains an OCSP URI, `conf/tls/site1_cert_chain.pem` contains the
-issuer certificate in addition to the server's, and
+This gives you an HTTPS site using the default set of cipher suites
+(see [`GnuTLSPriorities`](#gnutlspriorities)). OCSP stapling will be
+enabled if the server certificate contains an OCSP URI,
+`conf/tls/site1_cert_chain.pem` contains the issuer certificate in
+addition to the server's, and
 [mod\_socache\_shmcb](http://httpd.apache.org/docs/current/en/mod/mod_socache_shmcb.html)
 is loaded.