From c01675d34288018e46d8b92aacacac4151a85d8f Mon Sep 17 00:00:00 2001 From: Tatsuya Kinoshita Date: Wed, 10 Feb 2021 19:20:37 +0900 Subject: New option ssl_cipher to specify ciphers for TLSv1.2 and below --- rc.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'rc.c') diff --git a/rc.c b/rc.c index 35e262c..521e830 100644 --- a/rc.c +++ b/rc.c @@ -205,6 +205,7 @@ static int OptionEncode = FALSE; #define CMT_SSL_CA_FILE N_("File consisting of PEM encoded certificates of CAs") #endif /* USE_SSL_VERIFY */ #define CMT_SSL_FORBID_METHOD N_("List of forbidden SSL methods (2: SSLv2, 3: SSLv3, t: TLSv1.0, 5: TLSv1.1, 6: TLSv1.2, 7: TLSv1.3)") +#define CMT_SSL_CIPHER N_("SSL ciphers for TLSv1.2 and below (e.g. DEFAULT:@SECLEVEL=2)") #endif /* USE_SSL */ #ifdef USE_COOKIE #define CMT_USECOOKIE N_("Enable cookie processing") @@ -612,6 +613,8 @@ struct param_ptr params6[] = { struct param_ptr params7[] = { {"ssl_forbid_method", P_STRING, PI_TEXT, (void *)&ssl_forbid_method, CMT_SSL_FORBID_METHOD, NULL}, + {"ssl_cipher", P_STRING, PI_TEXT, (void *)&ssl_cipher, CMT_SSL_CIPHER, + NULL}, #ifdef USE_SSL_VERIFY {"ssl_verify_server", P_INT, PI_ONOFF, (void *)&ssl_verify_server, CMT_SSL_VERIFY_SERVER, NULL}, -- cgit v1.2.3