From 6270d755711fa8378615b087f780e5753c2d1dfb Mon Sep 17 00:00:00 2001 From: Bernhard Froehlich Date: Tue, 8 Jan 2019 15:09:29 +0000 Subject: [PATCH] Improve TLS Config to prefer server ciphers, remove 3DES ciphers and require TLS 1.1 or higher --- main.go | 48 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) diff --git a/main.go b/main.go index 79f756e..d5f18c6 100644 --- a/main.go +++ b/main.go @@ -192,6 +192,30 @@ func main() { } server.TLSConfig = &tls.Config { + PreferServerCipherSuites: true, + MinVersion: tls.VersionTLS11, + + // Ciphersuites as defined in stock Go but without 3DES + // https://golang.org/src/crypto/tls/cipher_suites.go + CipherSuites: []uint16 { + tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, + tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, + tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, + tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, + tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, + tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, + tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, + tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, + tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, + tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, + tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, + tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, + tls.TLS_RSA_WITH_AES_128_GCM_SHA256, // does not provide PFS + tls.TLS_RSA_WITH_AES_256_GCM_SHA384, // does not provide PFS + tls.TLS_RSA_WITH_AES_128_CBC_SHA256, + tls.TLS_RSA_WITH_AES_128_CBC_SHA, + tls.TLS_RSA_WITH_AES_256_CBC_SHA, + }, Certificates: [] tls.Certificate{cert}, } server.ForceTLS = *localForceTLS @@ -215,6 +239,30 @@ func main() { } server.TLSConfig = &tls.Config { + PreferServerCipherSuites: true, + MinVersion: tls.VersionTLS11, + + // Ciphersuites as defined in stock Go but without 3DES + // https://golang.org/src/crypto/tls/cipher_suites.go + CipherSuites: []uint16 { + tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, + tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, + tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, + tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, + tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, + tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, + tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, + tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, + tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, + tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, + tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, + tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, + tls.TLS_RSA_WITH_AES_128_GCM_SHA256, // does not provide PFS + tls.TLS_RSA_WITH_AES_256_GCM_SHA384, // does not provide PFS + tls.TLS_RSA_WITH_AES_128_CBC_SHA256, + tls.TLS_RSA_WITH_AES_128_CBC_SHA, + tls.TLS_RSA_WITH_AES_256_CBC_SHA, + }, Certificates: [] tls.Certificate{cert}, }