Re: Locking down ciphers in OpenLDAP with GnuTLS

To: Michael Ströder <michael@stroeder.com>
Subject: Re: Locking down ciphers in OpenLDAP with GnuTLS
From: Ryan Tandy <ryan@nardis.ca>
Date: Thu, 7 Feb 2019 09:09:06 -0800
Cc: Philip Colmer <philip.colmer@linaro.org>, openldap-technical@openldap.org
Content-disposition: inline
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nardis.ca; s=google; h=date:from:to:cc:subject:message-id:mail-followup-to:references :mime-version:content-disposition:content-transfer-encoding :in-reply-to:user-agent; bh=CjA4UN8f/oWg9Ty/4zsm6VCvF79VwUUONzDZb07SNM4=; b=hETNp+L5ppx5dCJNOMsrU048kxSPSoAffY2SzvGZNsXbWUL9NBBK8xTbWi5zG/GtwL DvOAMyv8h6vP9PpeeUUYf/N7o4bhQqiUIE2qdUK+eExb7HP+blhFvappUz5rACFSp2XF ux0lktNsjTS1tiqMCR7oXUgHFA8/kqyhANIQA=
In-reply-to: <d741f515-981c-1360-ab13-f43a1ef09b2f@stroeder.com>
Mail-followup-to: Michael Ströder <michael@stroeder.com>, Philip Colmer <philip.colmer@linaro.org>, openldap-technical@openldap.org
References: <CAKTSSTiG3sVOnUe=tXCXCvYnvVpp4kdX3LLnbndJX-q3xt-HmQ@mail.gmail.com> <d741f515-981c-1360-ab13-f43a1ef09b2f@stroeder.com>
User-agent: NeoMutt/20170113 (1.7.2)

On Thu, Feb 07, 2019 at 06:05:02PM +0100, Michael Ströder wrote:

You should rather set

olcTLSProtocolMin: 3.3

Unfortunately this option is currently implemented for OpenSSL only,while Philip mentioned he is using GnuTLS.

Follow-Ups:
- Re: Locking down ciphers in OpenLDAP with GnuTLS
  - From: Philip Colmer <philip.colmer@linaro.org>

References:
- Locking down ciphers in OpenLDAP with GnuTLS
  - From: Philip Colmer <philip.colmer@linaro.org>
- Re: Locking down ciphers in OpenLDAP with GnuTLS
  - From: Michael Ströder <michael@stroeder.com>