Re: httpd vs TLS

[tr%vispaul.me@localhost]

On 2016-03-16 18:19, Thomas Klausner wrote:
> Then I tried connecting to https://wip.pkgsrc.org and firefox went 
> haywire.

What version of Firefox?  You may want to try adjusting the cipher list, 
with
the "-z” flag. I personally use the intermediate compatibility list from 
Mozilla
instead of the httpd defaults:
https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28default.29

Without using that cipher list I get a SSL_ERROR_NO_CYPHER_OVERLAP in 
Firefox 45
and httpd logs the error:
SSL Error: SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher

I’m not a crypto expert so I rely on the list provided by Mozilla. We 
may need
to revise the default cipher list.

- Travis P