h2o / h2o/h2o

h2o define/use static OpenSSL & cipher suite order ?

Open
#85 5 comments 0 reactions 0 assignees View on GitHub
FAQ
Dominant language
C
Stars
11.5k
Forks
883
Avg merge
1m
Merged PRs (30d)
1

Description

**Background**
I am coming from CentOS OS background and Nginx SPDY/3.1 SSL background where in my [Centmin Mod LEMP web stack I configure Nginx to use OpenSSL static version](http://centminmod.com/nginx_configure_https_ssl_spdy.html) as I source compile Nginx so have the flexibility of using different OpenSSL versions i.e. OpenSSL 1.0.2 with added [chacha20_poly1305 cipher support](https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305-01) + [Cloudflare's kill RC4 OpenSSL patches](https://github.com/cloudflare/sslconfig) to OpenSSL source code.

**Questions**
1. Can h2o also define a static OpenSSL version that is not the system OpenSSL version ? How ?
2. Is there any finer grain control of SSL cipher suite preferences like using Mozilla's recommended SSL cipher suite preferences https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28default.29 ?

cheers

Contributor guide

Open the contributing guide

Research direction

Begin with H2O's current build and TLS configuration entry points, then check how the project links OpenSSL and exposes cipher-suite ordering. Done means determining whether a non-system OpenSSL can be selected and whether Mozilla-style preferences are supported, with the required configuration or build documentation identified.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
build-system, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.