[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: PFS Ciphers

To: Howard Chu <hyc@symas.com>
Subject: Re: PFS Ciphers
From: Emmanuel Dreyfus <manu@netbsd.org>
Date: Thu, 19 Sep 2013 07:32:47 +0000
Cc: Emmanuel Dreyfus <manu@netbsd.org>, openldap-technical@openldap.org
Content-disposition: inline
In-reply-to: <523A976F.8050005@symas.com>
References: <1l9fph2.1oizjofyp5zvmM%manu@netbsd.org> <523A976F.8050005@symas.com>
User-agent: Mutt/1.5.21 (2010-09-15)

On Wed, Sep 18, 2013 at 11:19:27PM -0700, Howard Chu wrote:
> Read the slapd.conf(5) or slapd-config(5) manpage. You must
> configure the TLSDHParamFile.

Thanks.

> Your ciphersuite is wrong anyway. You want DHE, not DH, for PFS.

Either I miss something subbtle, or I am right:

$ openssl ciphers  DH:!SHA:!aNULL|tr ':' '\n' 
DHE-DSS-AES256-GCM-SHA384
DHE-RSA-AES256-GCM-SHA384
DHE-RSA-AES256-SHA256
DHE-DSS-AES256-SHA256
DHE-DSS-AES128-GCM-SHA256
DHE-RSA-AES128-GCM-SHA256
DHE-RSA-AES128-SHA256
DHE-DSS-AES128-SHA256

$ openssl ciphers  DHE:!SHA:!aNULL|tr ':' '\n'
Error in cipher list

-- 
Emmanuel Dreyfus
manu@netbsd.org

Follow-Ups:
- Re: PFS Ciphers
  - From: manu@netbsd.org (Emmanuel Dreyfus)

References:
- PFS Ciphers
  - From: manu@netbsd.org (Emmanuel Dreyfus)
- Re: PFS Ciphers
  - From: Howard Chu <hyc@symas.com>

Prev by Date: Re: PFS Ciphers
Next by Date: TLS negation failure
Index(es):
- Chronological
- Thread