manu a3141bf547 Add support for ECDH, from upstream ... After the recent logjam attack, longer DH parameter size have been advised. Unfortunately, this comes with a high computational cost. ECDH is a good alternative to acheive forward secrecy with lower CPU Loads. This patch is a backport from upstream ECDH umplementation. ECDH is enabled by speciying a curve name through the TLSECName directive. Valid curve names can be obtaines by openssl ecparam -list_curves Advised usage for a forward-secrecy only setup wiht only ECDH: TLSCipherSuite EECDH:!RC4:!SHA:!MD5:!DES:!aNULL:!eNULL TLSECName prime256v1 If backward compatibility with older clients is required: TLSCipherSuite EECDH:HIGH:!RC4:!SHA:!MD5:!DES:!aNULL:!eNULL TLSECName prime256v1 Backward compatible flavor with more forward secrecy, at the expense of using costly DH. dh2048.pem is obtained using openssl dhparam 2048 > /etc/openssl/certs/dh2048.pem TLSCipherSuite EECDH:EDH:HIGH:!RC4:!SHA:!MD5:!DES:!aNULL:!eNULL TLSDHParamFile /etc/openssl/certs/dh2048.pem TLSECName prime256v1		2015-09-14 16:32:26 +00:00
..
DESCR
Makefile	Add support for ECDH, from upstream	2015-09-14 16:32:26 +00:00
MESSAGE.common
MESSAGE.NetBSD
options.mk	Now that _STRIPFLAG_INSTALL is disabled by default on Darwin, remove manual	2015-09-07 12:02:05 +00:00
PLIST	Remove example rc.d scripts from PLISTs.	2014-03-11 14:04:57 +00:00