Re: [PATCH] MINOR: ssl: skip self issued CA in cert chain for ssl_ctx

> Le 21 avr. 2020 à 10:58, William Lallemand a écrit : > > On Fri, Apr 03, 2020 at 10:34:12AM +0200, Emmanuel Hocdet wrote: >> >>> Le 31 mars 2020 à 18:40, William Lallemand a écrit >>> : >>> >>> On Thu, Mar 26, 2020 at 06:29:48PM +0100, William Lallemand wrote: After some thinki

Re: [PATCH] MINOR: ssl: skip self issued CA in cert chain for ssl_ctx

On Wed, Apr 22, 2020 at 11:23:05AM +0200, Emmanuel Hocdet wrote: > Hi William, > > It’s ok, thanks. I hope is the case for all of us. > > I will take time to do it. > > ++ > Manu > Okay, thanks! -- William Lallemand

[PATCH] MINOR: ssl: add ssl-skip-self-issued-ca global option

and voila: 0001-MINOR-ssl-add-ssl-skip-self-issued-ca-global-option.patch Description: Binary data

[PATCH] ssl defaults enhancements

Hi, please find attached to this mail two patches. One aims at addressing issue #595 on github, where Anit reports some server ssl options default values aren't applied when set with default-server or ssl-default-server-options directives. The other patch adds a new keyword in global section to

[PATCH] MINOR: crypto: Add digest and hmac converters

Make the digest and HMAC function of OpenSSL accessible to the user via converters. They can be used to sign and validate content. --- Makefile| 2 +- doc/configuration.txt | 9 reg-tests/sample_fetches/hashes.vtc | 22 src/crypto.c

Re: [PATCH] MINOR: crypto: Add digest and hmac converters

Patrick, Am 22.04.20 um 12:40 schrieb Patrick Gansterer: > diff --git a/doc/configuration.txt b/doc/configuration.txt > index 2e548b66c..17b2debe5 100644 > --- a/doc/configuration.txt > +++ b/doc/configuration.txt > @@ -13918,6 +13918,10 @@ debug([]) >Example: > tcp-request connection tra

Re: [PATCH 0/2] *** Add TT timer ***

Hi Damien, On Thu, Apr 16, 2020 at 04:03:19PM +, Damien Claisse wrote: > What I'm actually interested in is assessing real-world total time taken to > serve a client request (as seen from the client such as reported by cURL or > in a browser network performance tab, except for DNS lookup time)

Re: [PATCH] MINOR: ssl: add ssl-skip-self-issued-ca global option

On Wed, Apr 22, 2020 at 11:48:29AM +0200, Emmanuel Hocdet wrote: > > and voila: > > From fc1ae0229809d3eca7f7553ac210056c6537c4e4 Mon Sep 17 00:00:00 2001 > From: Emmanuel Hocdet > Date: Wed, 22 Apr 2020 11:06:19 +0200 > Subject: [PATCH] MINOR: ssl: add ssl-skip-self-issued-ca global option >

Re: [PATCH] ssl defaults enhancements

On Wed, Apr 22, 2020 at 12:06:15PM +0200, Jerome Magnin wrote: > Hi, > [...] > The other patch adds a new keyword in global section to set default bind > curves. > I updated the second patch to remove the ability to set the default curves at build time because I did it wrong and I'm not sure it'

Re: [PATCH] ssl defaults enhancements

On Wed, Apr 22, 2020 at 12:06:11PM +0200, Jerome Magnin wrote: > From d86993cbd4476e1901eafdc7fbe88d31ca6f8e90 Mon Sep 17 00:00:00 2001 > From: Jerome Magnin > Date: Wed, 22 Apr 2020 11:40:18 +0200 > Subject: [PATCH] BUG/MINOR: ssl: default settings for ssl server options are > not used > > Fro

Re: [ANNOUNCE] haproxy-2.1.4

Willy, Am 21.04.20 um 16:58 schrieb Willy Tarreau: >> I would also be interested in how Felix Wilhelm performed the fuzzing, >> do you happen to have details about that? > > No, I only got the information that was just made public. But do not > hesitate to contact Felix about this, I'm sure he wi

How to suppress weak ciphers

HA-Proxy version 1.7.10-a7dcc3b 2018/01/02 SSL Labs reports the CBC ciphers are "weak": [cid:image002.jpg@01D6117D.1C8AC910] I've tried to explicitly negate these ciphers with an "!" in haproxy.cfg to no avail: ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets ssl-d

Re: [PATCH] MINOR: crypto: Add digest and hmac converters

Tim, thanks for the review. I just rebased my old patch today and didn't check what changed in the meantime in the codebase. I created a separate patch to move aes_gcm_dec out of ssl_sock.c since it seams to fit better to my new file. - Patrick >From 8f6ce045c80e0f67a485233ee602b57b4c311bde Mo

Re: [PATCH] MINOR: crypto: Add digest and hmac converters

Patrick, Am 22.04.20 um 17:30 schrieb Patrick Gansterer: > Tim, > > thanks for the review. I just rebased my old patch today and didn't check > what > changed in the meantime in the codebase. I created a separate patch to move > aes_gcm_dec out of ssl_sock.c since it seams to fit better to my

Re: [PATCH] MINOR: crypto: Add digest and hmac converters

Tim, sorry for the troubles. My mail program added automatic line breaks. :-( I attached the two files now. - Patrick >From 8f6ce045c80e0f67a485233ee602b57b4c311bde Mon Sep 17 00:00:00 2001 From: Patrick Gansterer Date: Sun, 17 Jun 2018 11:21:11 +0200 Subject: [PATCH 1/2] MINOR: crypto: Move ae

Re: How to suppress weak ciphers

Hi Norman, On Wed, Apr 22, 2020 at 03:29:28PM +, Branitsky, Norman wrote: > HA-Proxy version 1.7.10-a7dcc3b 2018/01/02 > SSL Labs reports the CBC ciphers are "weak": > > [cid:image002.jpg@01D6117D.1C8AC910] > > I've tried to explicitly negate these ciphers with an "!" in haproxy.cfg to > no

Re: How to suppress weak ciphers

you can start with https://ssl-config.mozilla.org/ however, high security also means lower compatibility, i.e. old browsers fail on high security (ssl labs provide handshake table for that) ср, 22 апр. 2020 г. в 20:32, Branitsky, Norman < norman.branit...@tylertech.com>: > HA-Proxy version 1.7.10

Re: [PATCH] MINOR: crypto: Add digest and hmac converters

Patrick, Am 22.04.20 um 17:41 schrieb Patrick Gansterer: > diff --git a/doc/configuration.txt b/doc/configuration.txt > index 2e548b66c..6b5f5ecf9 100644 > --- a/doc/configuration.txt > +++ b/doc/configuration.txt > @@ -13918,6 +13918,13 @@ debug([]) >Example: > tcp-request connection tra

Re: [PATCH] MINOR: crypto: Add digest and hmac converters

Tim, thx for the quick review. I attached a new patchset. On Mittwoch, 22. April 2020 18:01:01 CEST Tim Düsterhus wrote: > Small nit: It should read 'e.g.' (with a dot at the end). Argh. Can't believe how many typos I made in this lines. ^^ > I believe you support a variable key now. You should

Re: [PATCH] MINOR: crypto: Add digest and hmac converters

Patrick, Am 22.04.20 um 18:23 schrieb Patrick Gansterer: > thx for the quick review. I attached a new patchset. > I don't find anything to complain about now. I'll now leave it up to the authority to either apply or complain. For MINOR: crypto: Add digest and hmac converters Reviewed-by: Tim D

RE: How to suppress weak ciphers

As you can see from my pasted configuration, I was specifying exactly 4 ciphers. The 2 weak CBC ciphers were magically appearing in the SSL Labs report. I tried to explicitly delete them - but the delete request is ignored. It seems that this entry, for example, must actually be a family: ECDHE-RS

RE: How to suppress weak ciphers

FWIW, here's what we use in production with HAProxy 2.1.4 statically linked with OpenSSL 1.1.1f, gives us an A rating with 90 score for cipher strength from SSLLabs test: # recommended modern ciphersuites. Qualys SSLLab reports some of them # as weak due to use of inferior CBC mode, but

Re: How to suppress weak ciphers

On Wed, Apr 22, 2020 at 06:20:14PM +, Branitsky, Norman wrote: > As you can see from my pasted configuration, I was specifying exactly 4 > ciphers. > The 2 weak CBC ciphers were magically appearing in the SSL Labs report. > I tried to explicitly delete them - but the delete request is ignored.

OT: I love this Project ;-)

Hi all. I know it's a little bit off topic but because I have in another project reached a big milestone, with the support of the People here, I would like to say. HAProxy People and Community and Program is really great ;-) ;-) ;-) ;-). Very best wishes Aleks

Response time by http method

Hi all. I think there is a really missing parameter in prometheus exporter that there is no response time metric by HTTP method. To monitor the state of response times there is a need of this metric. Any plan to be added? Issue: https://github.com/haproxy/haproxy/issues/580 Thanks,

"COVID-19: Face Masks & Hand Sanitizer"

Hello, Trying to get in contact with the purchasing team regarding face masks and hand sanitizer. We can urgently supply 3PY, N95, KN95, FFP2, FFP3, Hand Sanitizers, Gloves, Hazmat Suits at a great price. *Please check:* http://www.ppekits.net/supply/ Let me know if you have any questions. Th

RE: How to suppress weak ciphers

Jerome, Thanks for the clarification. This string: CHACHA20:AESGCM:AESCCM:!RSA resulted in an F grade from SSL Labs due to the inclusion of TLS_DH_anon ciphers: [cid:image001.jpg@01D61902.1FDF86A0] After adding the following to the end of the string, scored an A+: :!aNULL Norman Branits