Emmanuel Dreyfus wrote:
Hi
I tried to use ciphers that bring PFS for OpenLDAP, but it did not work.
I used this cipher specification:
TLSCipherSuite ECDH:DH:!SHA:!MD5:!aNULL:!eNULL
I test it this way:
for i in `openssl ciphers ALL|tr ':' '\n'` ; do
echo ''|openssl s_client -cipher $i -connect server:636 \
2>/dev/null |awk '/ Cipher/{print }' ;
done
I get nothing. I understand ECDH needs some support code, but why aren't
DH ciphers available?
Read the slapd.conf(5) or slapd-config(5) manpage. You must configure the
TLSDHParamFile.
Your ciphersuite is wrong anyway. You want DHE, not DH, for PFS.
--
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/