Remove SHA-1 cipher suites from the defaults on the server-side
Aperta
area/tls
help wanted
- Lingua principale
- C++
- Stelle
- 28.9k
- Fork
- 5.6k
- Merge medio
- 1g 22h
- PR unite (30g)
- 430
Descrizione
This is the intent to remove remaining SHA-1 cipher suites (i.e. `ECDHE-ECDSA-AES128-SHA`, `ECDHE-RSA-AES128-SHA`, `ECDHE-ECDSA-AES256-SHA` and `ECDHE-RSA-AES256-SHA`) from the default cipher suites on the server-side.
This change will affect your deployment if it's using default cipher suites (i.e. not configuring `cipher_suites`) and it's accepting incoming connections using those cipher suites:
```
$ curl -s localhost:9901/stats | grep -E "^listener.*.ssl.ciphers..*SHA:"
listener.
listener..ssl.ciphers.ECDHE-ECDSA-AES256-SHA: 1
listener..ssl.ciphers.ECDHE-RSA-AES128-SHA: 1
listener..ssl.ciphers.ECDHE-RSA-AES256-SHA: 1
```
(This works only with Envoy v1.9.0 and newer)
ETA: 1.15 (i.e. ~late 2020)
Guida per i contributori
Apri la guida per i contributori
Valutazione
Questa issue non è ancora stata valutata.