Haproxy: Minimse the cipher list that is exposed. Logging still shows…

… TlSv1.2, so we still support it for a while
OpenConext · Jul 4, 2024 · 6622e3d · 6622e3d
1 parent 957b3ac
commit 6622e3d
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/roles/haproxy/templates/haproxy_global.cfg.j2 b/roles/haproxy/templates/haproxy_global.cfg.j2
@@ -12,9 +12,9 @@ global
   ulimit-n    9000
   daemon
   ssl-default-bind-options no-sslv3 no-tls-tickets
-  ssl-default-bind-ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+AESGCM:DH+AES256:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS 
+  ssl-default-bind-ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128
   ssl-default-server-options no-sslv3 no-tls-tickets
-  ssl-default-server-ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+AESGCM:DH+AES256:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS 
+  ssl-default-server-ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128
 {% if haproxy_metricbeat %}
   stats socket 127.0.0.1:14567
 {% endif %}