gearheads
/
mastodon
Archived
2
0
Fork 0
Code Releases 4 Activity

ECDH only 

Disable DHE ciphers. We don't loose any compatibility as we already use TLS 1.2, and ECDH is faster and safer.
Also, it's better so specify the curve.

This is the conf I use here : https://tls.imirhil.fr/https/mstdn.io
gh/stable
Angristan 2017-04-05 10:44:08 +02:00 committed by GitHub
parent 792389da38
commit 5dbcd92193
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
docs/Running-Mastodon/Production-guide.md
View File

@ -23,7 +23,8 @@ server {
server_name example.com; server_name example.com;
ssl_protocols TLSv1.2; ssl_protocols TLSv1.2;
ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH'; ssl_ciphers EECDH+AESGCM:EECDH+AES;
ssl_ecdh_curve secp384r1;
ssl_prefer_server_ciphers on; ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m; ssl_session_cache shared:SSL:10m;