From 9799bea4a15bfceb6733f24dffdb9da77f815484 Mon Sep 17 00:00:00 2001 From: Jilles Tjoelker Date: Wed, 15 Jan 2014 22:13:47 +0100 Subject: [PATCH] openssl: Use cipher list suggested by Argure. --- libratbox/src/openssl.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libratbox/src/openssl.c b/libratbox/src/openssl.c index 86dfe6cd8..c1992f23f 100644 --- a/libratbox/src/openssl.c +++ b/libratbox/src/openssl.c @@ -316,6 +316,7 @@ rb_init_ssl(void) SSL_CTX_set_verify(ssl_server_ctx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, verify_accept_all_cb); SSL_CTX_set_session_id_context(ssl_server_ctx, (const unsigned char *)"libratbox", 9); + SSL_CTX_set_cipher_list(ssl_server_ctx, "EECDH+HIGH:EDH+HIGH:HIGH:!aNULL"); /* Set ECDHE on OpenSSL 1.00+, but make sure it's actually available because redhat are dicks and bastardise their OpenSSL for stupid reasons... */