Re: httpd vs TLS

[Mateusz Kocielski <shm%digitalsun.pl@localhost>]

On Thu, Mar 17, 2016 at 03:48:49PM +0100, Thomas Klausner wrote:
> On Thu, Mar 17, 2016 at 03:42:39PM +0100, Martin Husemann wrote:
> > On Thu, Mar 17, 2016 at 03:36:29PM +0100, Thomas Klausner wrote:
> > > No, I want wip.pkgsrc.org to be reachable with https by default.
> > > I can't ask everyone to change their browser.
> > 
> > My Firefox uses TLS_RSA_WITH_AES_128_CBC_SHA, 128 bit keys, TLS 1.2
> > when talking to wip.pkgsrc.org.
> > 
> > Why would a -current httpd not provide that?
> > 
> > Thomas, could you run the -current binary on a different port so others
> > can examine this issue more closely?
> 
> Sure, I've started one on port 4443.
> 
> https://wip.pkgsrc.org:4443/cgi-bin/gitweb.cgi

Hi there,

 I've done quick tests using ssllabs (https://www.ssllabs.com/), here's a
part of the report: http://www.netbsd.org/~shm/bozo-ssl.txt . It shows that
older browsers have troubles in connecting to bozo as it's current
configuration is too restrictive.

 Regards,
 Mateusz