h2o define/use static OpenSSL & cipher suite order ?
- Dominant language
- C
- Stars
- 11.5k
- Forks
- 883
- Avg merge
- 1m
- Merged PRs (30d)
- 1
Description
**Background**
I am coming from CentOS OS background and Nginx SPDY/3.1 SSL background where in my [Centmin Mod LEMP web stack I configure Nginx to use OpenSSL static version](http://centminmod.com/nginx_configure_https_ssl_spdy.html) as I source compile Nginx so have the flexibility of using different OpenSSL versions i.e. OpenSSL 1.0.2 with added [chacha20_poly1305 cipher support](https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305-01) + [Cloudflare's kill RC4 OpenSSL patches](https://github.com/cloudflare/sslconfig) to OpenSSL source code.
**Questions**
1. Can h2o also define a static OpenSSL version that is not the system OpenSSL version ? How ?
2. Is there any finer grain control of SSL cipher suite preferences like using Mozilla's recommended SSL cipher suite preferences https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28default.29 ?
cheers
Contributor guide
Research direction
Begin with H2O's current build and TLS configuration entry points, then check how the project links OpenSSL and exposes cipher-suite ordering. Done means determining whether a non-system OpenSSL can be selected and whether Mozilla-style preferences are supported, with the required configuration or build documentation identified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- build-system, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100