From 7863ed1f85673fc0626181e7af8b05f9b1778d44 Mon Sep 17 00:00:00 2001 From: Mark Tompsett Date: Tue, 7 Jul 2020 17:04:21 -0400 Subject: [PATCH] Bug 25948: Clean up apache-site-https a little - removed ECDHE-RSA-AES256-SHA384, as it downgrades to CBC use https://ciphersuite.info/cs/TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384/ - added DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256 - added ECDHE-ECDSA-AES256-SHA384 - removed cut-off ECDHE-RSA-SA- and ECDHE-RSA-AES - made OPAC and Intranet sections match - removed TLSv1 https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html https://blogs.windows.com/msedgedev/2020/03/31/tls-1-0-tls-1-1-schedule-update-edge-ie11/ https://www.entrustdatacard.com/blog/2018/november/deprecating-tls - did not remove TLSv1.1 as this would break support for older browsers probably still in use. - did not add TLSv1.3 as it depends on OS used and version of openSSL if it is supported or not. This may break support for some things, but nothing semi-current. I don't care about ie 11 on windows 8.1 phones, or safari 6-8. Also, people using letsencrypt.org should look into using a DNS CAA record for their opac site URL, issued by letsencrypt.org with flags set to 0. This affects the installation using: sudo koha-create --letsencrypt --create-db instance BEFORE using this command recently, I needed to disable the 000-default site, and had to create a directory /usr/share/koha/intranet/htdocs/.well-known/acme-challenge which I also softlinked from /usr/share/koha/opac/htdocs/.well-known/acme-challenge to the intranet one. --- debian/templates/apache-site-https.conf.in | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/debian/templates/apache-site-https.conf.in b/debian/templates/apache-site-https.conf.in index 196a415b8e..863925a846 100644 --- a/debian/templates/apache-site-https.conf.in +++ b/debian/templates/apache-site-https.conf.in @@ -12,10 +12,10 @@ # OPAC #https # SSLEngine on -# SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 +# SSLProtocol -all +TLSv1.2 +TLSv1.1 # SSLCompression off # SSLHonorCipherOrder on -# SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-SA- +# SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256" # SSLCertificateKeyFile /etc/letsencrypt/live/__OPACSERVER__/privkey.pem # SSLCertificateFile /etc/letsencrypt/live/__OPACSERVER__/cert.pem # SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem @@ -39,10 +39,10 @@ # Intranet #https # SSLEngine on -# SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 +# SSLProtocol -all +TLSv1.2 +TLSv1.1 # SSLCompression off # SSLHonorCipherOrder on -# SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES +# SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256" # SSLCertificateKeyFile /etc/letsencrypt/live/__OPACSERVER__/privkey.pem # SSLCertificateFile /etc/letsencrypt/live/__OPACSERVER__/cert.pem # SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem -- 2.25.1