diff options
| author | jim-p <jimp@pfsense.org> | 2012-07-18 18:14:22 -0400 |
|---|---|---|
| committer | jim-p <jimp@pfsense.org> | 2012-07-18 18:14:22 -0400 |
| commit | 3cd2ea2c5c7a5bd98ce0efc8de5f568d3226c8ea (patch) | |
| tree | 110c5572bba622bb3bb88cde9a92e22f43dffdbc | |
| parent | 6103e9eb8057630950203cf2b84e984b5f9d7c58 (diff) | |
| download | pfsense-3cd2ea2c5c7a5bd98ce0efc8de5f568d3226c8ea.zip pfsense-3cd2ea2c5c7a5bd98ce0efc8de5f568d3226c8ea.tar.gz | |
Expand cipher list and remove a cipher that Safari on iOS does not like after recent lighttpd changes. Fixes #2553
| -rw-r--r-- | etc/inc/system.inc | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/etc/inc/system.inc b/etc/inc/system.inc index 5e9d01d..0501acf 100644 --- a/etc/inc/system.inc +++ b/etc/inc/system.inc @@ -1193,7 +1193,7 @@ EOD; // Harden SSL a bit for PCI conformance testing $lighty_config .= "ssl.use-sslv2 = \"disable\"\n"; - $lighty_config .= "ssl.cipher-list = \"TLSv1+HIGH !SSLv2 RC4+MEDIUM !aNULL !eNULL !3DES @STRENGTH\"\n"; + $lighty_config .= "ssl.cipher-list = \"DHE-RSA-CAMELLIA256-SHA:DHE-DSS-CAMELLIA256-SHA:CAMELLIA256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-DSS-CAMELLIA128-SHA:CAMELLIA128-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA:RC4-SHA:RC4-MD5:!aNULL:!eNULL:!3DES:@STRENGTH\"\n"; if(!(empty($ca) || (strlen(trim($ca)) == 0))) $lighty_config .= "ssl.ca-file = \"{$g['varetc_path']}/{$ca_location}\"\n\n"; |
