From 2814ae269d86fa9c6bb2fd2abe37adc9e442c9bb Mon Sep 17 00:00:00 2001 From: Andrew Bonney Date: Fri, 5 Aug 2022 10:43:47 +0100 Subject: [PATCH] tls1.2: update ciphers to latest recommendations Based upon usual recommendations from: https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/ Change-Id: Ic7bd2c04e850f31952493163c2a4050909b38388 --- defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/defaults/main.yml b/defaults/main.yml index 741942ec..4c6a47b5 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -216,7 +216,7 @@ horizon_ssl_key: /etc/ssl/private/horizon.key horizon_ssl_ca_cert: /etc/ssl/certs/horizon-ca.pem horizon_ssl_protocol: "{{ ssl_protocol | default('ALL -SSLv2 -SSLv3 -TLSv1 -TLSv1.1') }}" # TLS v1.2 and below -horizon_ssl_cipher_suite_tls12: "{{ horizon_ssl_cipher_suite | default(ssl_cipher_suite | default('ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS')) }}" +horizon_ssl_cipher_suite_tls12: "{{ horizon_ssl_cipher_suite | default(ssl_cipher_suite | default('ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES256:ECDH+AES128:!aNULL:!SHA1:!AESCCM')) }}" # TLS v1.3 horizon_ssl_cipher_suite_tls13: "{{ ssl_cipher_suite_tls13 | default('TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256') }}" # if using a self-signed certificate, set this to true to regenerate it