Merge "Force force-tlsv12 only"

This commit is contained in:
Zuul 2018-12-17 17:16:45 +00:00 committed by Gerrit Code Review
commit 7d8b9f31ad
2 changed files with 8 additions and 1 deletions

View File

@ -70,7 +70,7 @@ haproxy_ssl_pem: /etc/ssl/private/haproxy.pem
haproxy_ssl_ca_cert: /etc/ssl/certs/haproxy-ca.pem
haproxy_ssl_self_signed_subject: "/C=US/ST=Texas/L=San Antonio/O=IT/CN={{ external_lb_vip_address }}/subjectAltName=IP.1={{ external_lb_vip_address }}"
haproxy_ssl_cipher_suite: "{{ ssl_cipher_suite | default('ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS') }}"
haproxy_ssl_bind_options: "no-sslv3"
haproxy_ssl_bind_options: "force-tlsv12"
# hatop extra package URL and checksum
haproxy_hatop_download_url: "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/hatop/hatop-0.7.7.tar.gz"

View File

@ -0,0 +1,7 @@
---
security:
- |
The default TLS version has been set to force-tlsv12. This only allows
version 1.2 of the protocol to be used when terminating or creating TLS
connections. You can change the value with the haproxy_ssl_bind_options
variable.