jinql
/
openssl-patch
mirror of https://github.com/hakasenyang/openssl-patch
1
0
Fork 0
Code Issues Releases Wiki Activity
69 Commits
4 Branches
0 Tags
372 KiB
Diff 99.9%
Shell 0.1%
 
 
Go to file
Hakase e051e9d866 Update README.md 2018-06-05 08:26:43 +09:00
README.md Update README.md 2018-06-05 08:26:43 +09:00
nginx_hpack_push.patch Fix nginx hpack push error. 2018-06-04 05:43:32 +09:00
openssl-equal-pre2.patch Add the pre2 version again. 2018-06-05 08:03:41 +09:00
openssl-equal-pre7.patch Update files - Remove pre2, pre6 and Update pre7. 2018-06-05 07:48:56 +09:00
openssl-equal-pre7_ciphers.patch Update files - Remove pre2, pre6 and Update pre7. 2018-06-05 07:48:56 +09:00
openssl-equal-pre8.patch Weak 3DES cipher is not used in TLSv1.1 or later. 2018-06-04 20:41:10 +09:00
openssl-equal-pre8_ciphers.patch Weak 3DES cipher is not used in TLSv1.1 or later. 2018-06-04 20:41:10 +09:00

README.md

openssl-patch

OpenSSL Equal Preference Patch

This file is not an official OpenSSL patch. Problems can arise and this is your responsibility.

Support TLS 1.3 draft 28 browsers - Chrome Canary, Firefox Nightly

Latest patch : openssl-equal-pre8.patch, openssl-equal-pre8_ciphers.patch

View Tree (OpenSSL)

Original source by BoringSSL & buik

OpenSSL 1.1.0h patch is here

Patch files

Here is the basic patch content.

  • Support TLS 1.3 draft 23 + 28 (Not support pre2)
    • Server: draft 23 + 28
    • Client: draft 23 + 26 + 27 + 28
  • BoringSSL's Equal Preference Patch
  • Weak 3DES and not using ECDHE ciphers is not used in TLSv1.1 or later.
Patch file name Patch list
openssl-equal-pre2.patch Not support draft 28.
openssl-equal-pre7.patch
openssl-equal-pre8.patch		 TLS 1.3 cipher settings can not be changed on nginx.
openssl-equal-pre7_ciphers.patch
openssl-equal-pre8_ciphers.patch		 TLS 1.3 cipher settings can be changed on nginx.

The "_ciphers" patch file is a temporary change to the TLS 1.3 configuration.

Example of setting TLS 1.3 cipher in nginx (pre7 or higher):

  • ex 1. TLS13+AESGCM+AES128:TLS13+AESGCM+AES256:TLS13+CHACHA20
  • ex 2. TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
  • ex 3. TLS13+AESGCM+AES128:EECDH+AES128 (TLS 1.3 + TLS 1.2 ciphers)

nginx Configuration (ssl_ciphers)

Default settings

ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
ssl_ciphers [Copy it from below and paste it here.];
ssl_ecdh_curve X25519:P-256:P-384;
ssl_prefer_server_ciphers on;

OpenSSL-1.1.1-pre2 ciphers (draft 23)

[TLS13-AES-128-GCM-SHA256|TLS13-AES-256-GCM-SHA384|TLS13-CHACHA20-POLY1305-SHA256]:[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA:RSA+AES128+SHA:RSA+AES256+SHA:RSA+3DES

OpenSSL-1.1.1-pre7, pre8 ciphers (draft 23, 28)

[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA:RSA+AES128+SHA:RSA+AES256+SHA:RSA+3DES

OpenSSL-1.1.1-pre7_ciphers, pre8_ciphers ciphers (draft 23, 28)

[TLS13+AESGCM+AES128|TLS13+AESGCM+AES256|TLS13+CHACHA20]:[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA:RSA+AES128+SHA:RSA+AES256+SHA:RSA+3DES