[packages/lighttpd] - update to current intermediate mozilla recommendation

[arekm]

commit d62b97cfd5a06a6dd72d67fba064e9b4d1fb240d
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date:   Tue Oct 22 14:52:03 2019 +0200

    - update to current intermediate mozilla recommendation

 ssl.conf | 21 ++++++++++-----------
 1 file changed, 10 insertions(+), 11 deletions(-)
---
diff --git a/ssl.conf b/ssl.conf
index e9c1a21..15bfb6a 100644
--- a/ssl.conf
+++ b/ssl.conf
@@ -33,21 +33,20 @@ $SERVER["socket"] == ":443" {
 #		"HTTPS" => "on"
 #	)
 
+	# https://ssl-config.mozilla.org/#server=lighttpd&server-version=1.4.54&config=intermediate
 	# intermediate configuration, tweak to your needs
+	#
 	ssl.use-sslv2 = "disable"
 	ssl.use-sslv3 = "disable"
-	ssl.honor-cipher-order = "enable"
-	# If you know you have RSA keys (standard), you can use:
-	#ssl.cipher-list = "aRSA+HIGH !3DES +kEDH +kRSA !kSRP !kPSK"
-	# The more generic version (without the restriction to RSA keys) is
-	#ssl.cipher-list = "HIGH !aNULL !3DES +kEDH +kRSA !kSRP !kPSK"
-	# List from https://mozilla.github.io/server-side-tls/ssl-config-generator/
-	ssl.cipher-list = "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS"
+	# intermediate configuration, tweak to your needs
+	ssl.openssl.ssl-conf-cmd = ("Protocol" => "ALL, -SSLv2, -SSLv3, -TLSv1, -TLSv1.1")
+	ssl.cipher-list           = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"
+	ssl.honor-cipher-order    = "disable"
 
-	# HSTS(15768000 seconds = 6 months)
-#	setenv.add-response-header = (
-#		"Strict-Transport-Security" => "max-age=15768000;"
-#	)
+	# HTTP Strict Transport Security (63072000 seconds
+	# setenv.add-response-header  = (
+	# 	"Strict-Transport-Security" => "max-age=63072000"
+	# )
 
 	$HTTP["useragent"] =~ "MSIE" {
 		server.max-keep-alive-requests = 0
================================================================

---- gitweb:

http://git.pld-linux.org/gitweb.cgi/packages/lighttpd.git/commitdiff/d62b97cfd5a06a6dd72d67fba064e9b4d1fb240d