Disable SSL/TLS renegotiation

Commit 2b77e8f020 allows to disable
TLS < 1.3, extend it to always disable SSL/TLS renegotiation even
for this older TLS protocols.

2b77e8f020
https://sourceforge.net/p/webadmin/bugs/4590/
This commit is contained in:
Timo Gurr
2022-08-16 11:28:48 +02:00
parent 20f40d0d38
commit 76bf648f94

View File

@@ -4664,6 +4664,10 @@ if ($config{'ssl_honorcipherorder'}) {
&Net::SSLeay::OP_CIPHER_SERVER_PREFERENCE)';
}
# Disable TLS renegotiation when possible, OpenSSL >= 1.1.0h
eval 'Net::SSLeay::CTX_set_options($ssl_ctx,
&Net::SSLeay::OP_NO_RENEGOTIATION)';
return { 'keyfile' => $keyfile,
'keytime' => $kst[9],
'certfile' => $certfile,