Re: Safe default SSL ciphers

2014-07-10 Thread Christopher Schultz
Mark, On 7/9/14, 12:46 PM, Mark Thomas wrote: On a related topic, it would be extremely useful if the available ciphers were exposed through the native interface. Anyone with C skills fancy taking a look? My main motivation for this is that we can write a unit test that checks the mapping

Re: Safe default SSL ciphers

2014-07-10 Thread Mark Thomas
On 10/07/2014 11:20, jean-frederic clere wrote: On 09/07/14 18:46, Mark Thomas wrote: snip/ My main motivation for this is that we can write a unit test that checks the mapping of OpenSSL ciphers to JSSE ciphers and highlights (by a failure) when the mapping changes (e.g. one of them adds

Re: Safe default SSL ciphers

2014-07-10 Thread Christopher Schultz
Mark, On 7/10/14, 11:01 AM, Mark Thomas wrote: On 10/07/2014 14:27, Christopher Schultz wrote: Mark, On 7/9/14, 12:46 PM, Mark Thomas wrote: On a related topic, it would be extremely useful if the available ciphers were exposed through the native interface. Anyone with C skills fancy

Re: Safe default SSL ciphers

2014-07-09 Thread jean-frederic clere
On 09/07/14 02:22, Konstantin Kolinko wrote: 2014-07-08 23:52 GMT+04:00 Rémy Maucherat r...@apache.org: Hi, Using the newly added OpenSSL syntax processor, a safe default cipher suite can be expressed as (for both native and JSSE): HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5 This avoids weak