Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 01 Jun 2015 19:02:57 -0500
From:      Tim Daneliuk <tundra@tundraware.com>
To:        d@delphij.net, FreeBSD Ports Mailing List <freebsd-ports@FreeBSD.ORG>
Subject:   Re: Port Fetch Failing
Message-ID:  <556CF2B1.30100@tundraware.com>
In-Reply-To: <556CEEB8.2090406@delphij.net>
References:  <556CEBE2.7030005@tundraware.com> <556CEEB8.2090406@delphij.net>

next in thread | previous in thread | raw e-mail | index | archive | help
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 06/01/2015 06:46 PM, Xin Li wrote:
> You seem to be using FreeBSD 9.x which does not support TLSv1.1 and
> TLSv1.2.  

No, it is 10.1-Stable

> Disabling SSLv3 ciphers means there would be no cipher available for
> TLSv1 negotiation:
> 
> % openssl ciphers 'TLSv1:-SSLv3'
> Error in cipher list
> 34379234072:error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no
> cipher
> match:/usr/src/secure/lib/libssl/../../../crypto/openssl/ssl/ssl_lib.c:1
> 294:
> 
> So, no negotiation would succeed in this case.
> 
> I find your CipherSuite quite problematic, by the way.  Why do you
> enable eNULL there for instance?

This is what happens when you are:  A) In a hurry and B) Paranoid and 
C) Willing to copypasta a config without thought :(

Thanks to you and Chuck, I have a more reasonable (I think):

SSLCipherSuite  ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+EXP:-eNULL:-SSLv3:-SSLv2:TLS_RSA_WITH_AES_256_CBC_SHA:TLS_RSA_WITH_AES_256_CBC_SHA256

Thanks for your prompt response,
- -- 
- ----------------------------------------------------------------------------
Tim Daneliuk     tundra@tundraware.com
PGP Key:         http://www.tundraware.com/PGP/

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)

iQIcBAEBAgAGBQJVbPKxAAoJEMLZ2alfelsnB1YP/AhzECzSgJPW6SbcjR4mJiGF
dg2ywz36W/BDcxj1jPnLdf99b0NTlGe6FMVtGi9GpcVVO1EpKbZS9jtHx4okPlYH
oOAIZnedF0+g/M2HOLLsij4EexQo2vcxyZ+S+DaKJkx4j9J2MQCMfzmDMDV3vr1m
7ErxipWuUq9+uoSJXE+JsvP3U2spmG+LGs/l2gIHwv7E2fvf63Ozb1Eo9e8NgLpf
9VO7jrghJDIGy4MUqWxMV6gqBl04rite0A46OUrJCvz78fB50YIW2tZXGafGpZ+H
jd0uAqpTukvvxiVXYHpO+EWhIJpgbI96FgizZ7Zp6jPrAALC+hAfE7JA5OkLAMno
CPvTj8jIn7SfF4e27OvhstDrUlJ3xuldKY3zbSebAK7Tee7i7oTU7h/6aKFv3fat
o7qB89LUQZfFRMvrReiXVHlUawYUcE2YKSpuu0ZOOux12kb1wc7Yes08xDOj6lkH
OTOUw7RWnvgm2exbzfzNBCZI/qa7VFixfB89eavP7Cfc2sYWTdrHky45yroLXABK
Ek8w49iQnio3wf/sWuzymCJQ+aMMaA/vGzr/cDampYSBwXkEX6Rql8oh83hQST50
2ZNHGVjwzOgxs+4xUYpQTEzvtzX8DmbMNNUkBk9Bfiv67mTMHn3xV3cayFgA+Aq2
CihAOZ94Oi+UhAT34PKP
=vMg0
-----END PGP SIGNATURE-----



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?556CF2B1.30100>