Skip to content

Conversation

@rnewson
Copy link
Member

@rnewson rnewson commented Sep 2, 2024

Overview

Allow configuration of signature algorithms and allowed ECC curves

Testing recommendations

Related Issues or Pull Requests

closes #5211

Checklist

  • Code is written and works correctly
  • Changes are covered by tests
  • Any new configurable parameters are documented in rel/overlay/etc/default.ini
  • Documentation changes were made in the src/docs folder
  • Documentation changes were backported (separated PR) to affected branches

Copy link
Contributor

@big-r81 big-r81 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice!

+1

@big-r81
Copy link
Contributor

big-r81 commented Sep 2, 2024

@rnewson Should we add some sensitive and safe defaults in default.ini?

@rnewson
Copy link
Member Author

rnewson commented Sep 2, 2024

No, I think let erlang/OTP version + mochiweb determine the default, and then a simple override.

We could submit a PR to mochiweb though, its defaults and notion of what is currently "safe" or not "broken" is quite out of date: https://github.com/mochi/mochiweb/blob/611254eb941e502227f221667389b98fd8e72d6f/src/mochiweb_socket.erl#L58

@rnewson rnewson merged commit 63c9113 into main Sep 3, 2024
@rnewson rnewson deleted the tls-server-options branch September 3, 2024 15:36
@nsthakur7
Copy link

nsthakur7 commented Sep 3, 2024

Thank you, Robert for actioning the fix so quickly. Any clue, when this fix will be released and which version(s) of couchDB have this fix?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

QID-38863 | Weak SSL/TLS Key Exchange - can't find a way to specify strong TLS/SSL exchange key - ECC curves

4 participants