3.9 KiB
3.9 KiB
openssl-patch
OpenSSL Equal Preference Patch
This file is not an official OpenSSL patch. Problems can arise and this is your responsibility.
Original Sources
You can find the OpenSSL 1.1.0h patch is here.
Information
- Test Page - (TLS 1.3 draft 23, 28)
- SSL Test Result - testssl.sh
- SSL Test Result - dev.ssllabs.com
- If you link site to a browser that supports draft 23 or 28, you'll see a TLS 1.3 message.
Support TLS 1.3 draft 28 browsers - Chrome Canary, Firefox Nightly
Compatible OpenSSL-1.1.1-pre8-dev (OpenSSL, 22330 commits)
Patch files
Here is the basic patch content.
- Support TLS 1.3 draft 23 + 28 (Not support pre2)
- Server: draft 23 + 28
- Client: draft 23 + 26 + 27 + 28
- BoringSSL's Equal Preference Patch
- Weak 3DES and not using ECDHE ciphers is not used in TLSv1.1 or later.
| Patch file name | Patch list |
|---|---|
| openssl-equal-pre2.patch | Not support draft 28. |
| openssl-equal-pre7.patch openssl-equal-pre8.patch |
TLS 1.3 cipher settings can not be changed on nginx. |
| openssl-equal-pre7_ciphers.patch openssl-equal-pre8_ciphers.patch |
TLS 1.3 cipher settings can be changed on nginx. |
The "_ciphers" patch file is a temporary change to the TLS 1.3 configuration.
Example of setting TLS 1.3 cipher in nginx (pre7 or higher):
- ex 1. TLS13+AESGCM+AES128:TLS13+AESGCM+AES256:TLS13+CHACHA20
- ex 2. TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
- ex 3. TLS13+AESGCM+AES128:EECDH+AES128 (TLS 1.3 + TLS 1.2 ciphers)
Not OpenSSL patch files
| Patch file name | Patch list |
|---|---|
| nginx_hpack_push.patch | Patch both the HPACK patch and the PUSH ERROR. |
| nginx_hpack_push_fix.patch | Patch only the PUSH ERROR of the hpack patch. (If the HPACK patch has already been completed) |
nginx Configuration (ssl_ciphers)
Default settings
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
ssl_ciphers [Copy it from below and paste it here.];
ssl_ecdh_curve X25519:P-256:P-384;
ssl_prefer_server_ciphers on;
OpenSSL-1.1.1-pre2 ciphers (draft 23)
[TLS13-AES-128-GCM-SHA256|TLS13-AES-256-GCM-SHA384|TLS13-CHACHA20-POLY1305-SHA256]:[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA:RSA+AES128+SHA:RSA+AES256+SHA:RSA+3DES
OpenSSL-1.1.1-pre7, pre8 ciphers (draft 23, 28)
[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA:RSA+AES128+SHA:RSA+AES256+SHA:RSA+3DES
OpenSSL-1.1.1-pre7_ciphers, pre8_ciphers ciphers (draft 23, 28)
[TLS13+AESGCM+AES128|TLS13+AESGCM+AES256|TLS13+CHACHA20]:[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA:RSA+AES128+SHA:RSA+AES256+SHA:RSA+3DES