From 8efa6a34f4a055bb184a5303e94bafdb994bbddd Mon Sep 17 00:00:00 2001
From: Glenn Strauss <gstrauss@gluelogic.com>
Date: Tue, 19 Feb 2019 03:38:24 -0500
Subject: [mod_openssl] default: ssl.cipher-list = "HIGH"

---
 doc/config/lighttpd.conf | 51 ++++++++++++++----------------------------------
 1 file changed, 15 insertions(+), 36 deletions(-)

(limited to 'doc')

diff --git a/doc/config/lighttpd.conf b/doc/config/lighttpd.conf
index 7673535e..c8def059 100644
--- a/doc/config/lighttpd.conf
+++ b/doc/config/lighttpd.conf
@@ -422,55 +422,34 @@ server.upload-dirs = ( "/var/tmp" )
 ##   ssl.engine = "enable"
 ##   ssl.pemfile = "/path/to/server.pem"
 ##
-## The HTTPS protocol does not allow you to use name-based virtual
-## hosting with SSL. If you want to run multiple SSL servers with
-## one lighttpd instance you must use IP-based virtual hosting: ::
-##
-## Mitigate CVE-2009-3555 by disabling client triggered renegotation
-## This is enabled by default.
-##
-## IMPORTANT: this setting can only be used in the global scope.
-## It does *not* work inside conditionals
-##
-#   ssl.disable-client-renegotiation = "enable"
-##
 ##   $SERVER["socket"] == "10.0.0.1:443" {
 ##     ssl.engine                  = "enable"
 ##     ssl.pemfile                 = "/etc/ssl/private/www.example.com.pem"
-##     #
-##     # (Following SSL/TLS Deployment Best Practices 1.3 / 17 September 2013 from:
-##     # https://www.ssllabs.com/projects/best-practices/index.html)
-##     # - BEAST is considered mitigaed on client side now, and new weaknesses have been found in RC4,
-##     #   so it is strongly advised to disable RC4 ciphers (HIGH doesn't include RC4)
-##     # - It is recommended to disable 3DES too (although disabling RC4 and 3DES breaks IE6+8 on Windows XP,
-##     #   so you might want to support 3DES for now - just remove the '!3DES' parts below).
-##     # - The examples below prefer ciphersuites with "Forward Secrecy" (and ECDHE over DHE (alias EDH)), remove '+kEDH +kRSA'
-##     #   if you don't want that.
-##     # - SRP and PSK are not supported anyway, excluding those ('!kSRP !kPSK') just keeps the list smaller (easier to review)
-##     # Check your cipher list with: openssl ciphers -v '...' (use single quotes as your shell won't like ! in double quotes)
-##     #
-##     # If you know you have RSA keys (standard), you can use:
-##     ssl.cipher-list             = "aRSA+HIGH !3DES +kEDH +kRSA !kSRP !kPSK"
-##     # The more generic version (without the restriction to RSA keys) is
-##     # ssl.cipher-list           = "HIGH !aNULL !3DES +kEDH +kRSA !kSRP !kPSK"
-##     #
-##     # Make the server prefer the order of the server side cipher suite instead of the client suite.
-##     # This option is enabled by default, but only used if ssl.cipher-list is set.
-##     #
-##     # ssl.honor-cipher-order = "enable"
-##     #
+##
+##     # Check your cipher list with: openssl ciphers -v '...'
+##     # (use single quotes as your shell won't like ! in double quotes)
+##     #ssl.cipher-list             = "HIGH"   # default
+##
+##     # (recommended to accept only TLSv1.2 and TLSv1.3)
+##     #ssl.openssl.ssl-conf-cmd = ("Protocol" => "-ALL, TLSv1.2, TLSv1.3")
+##
 ##     server.name                 = "www.example.com"
 ##
 ##     server.document-root        = "/srv/www/vhosts/example.com/www/"
 ##   }
 ##
 
-## If you have a .crt and a .key file, cat them together into a
-## single PEM file:
+## If you have a .crt and a .key file, specify both ssl.pemfile and ssl.privkey,
+## or cat them together into a single PEM file:
 ## $ cat /etc/ssl/private/lighttpd.key /etc/ssl/certs/lighttpd.crt \
 ##   > /etc/ssl/private/lighttpd.pem
 ##
 #ssl.pemfile = "/etc/ssl/private/lighttpd.pem"
+#
+# or
+#
+#ssl.privkey = "/etc/ssl/private/privkey.pem"
+#ssl.pemfile = "/etc/ssl/private/cert.pem"
 
 ##
 ## optionally pass the CA certificate here.
-- 
cgit v1.2.1