From 92ae1b678ad82fd3c31430b38699a70c1f1d15d9 Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Thu, 27 Dec 2018 06:21:50 -0500 Subject: [PATCH 1/2] feat: increase RSA bit keys to 4096 Refs #3343 --- plugins/nginx-vhosts/install | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugins/nginx-vhosts/install b/plugins/nginx-vhosts/install index c587c6dd6..d35190584 100755 --- a/plugins/nginx-vhosts/install +++ b/plugins/nginx-vhosts/install @@ -30,7 +30,7 @@ chmod 0440 /etc/sudoers.d/dokku-nginx # if dhparam.pem has not been created, create it the first time if [[ ! -f /etc/nginx/dhparam.pem ]]; then - openssl dhparam -out /etc/nginx/dhparam.pem 2048 + openssl dhparam -out /etc/nginx/dhparam.pem 4096 chown root:root /etc/nginx/dhparam.pem fi From ba8037b4bdc48c9f98acdc7b4b51f0192f472e12 Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Thu, 27 Dec 2018 06:22:37 -0500 Subject: [PATCH 2/2] feat: switch to move secure ssl ciphers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The cipher list is from from https://cipherli.st/ and will remove a few older browsers: - Android 5.0 - Android 6.0 - Chrome 49 / XP SP3 - Firefox 31.3.0 ESR / Win 7 - Firefox 47 / Win 7  R - IE 11 / Win Phone 8.1 I _think_ thats an okay drop - dropping Android kinda hurts, but we're far from the only ones dropping them from being served, and our users are free to override these settings on their own servers. Closes #3343 --- plugins/nginx-vhosts/install | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugins/nginx-vhosts/install b/plugins/nginx-vhosts/install index d35190584..348f4e813 100755 --- a/plugins/nginx-vhosts/install +++ b/plugins/nginx-vhosts/install @@ -47,7 +47,7 @@ ssl_session_timeout 1d; ssl_session_tickets on; ssl_dhparam /etc/nginx/dhparam.pem; -ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS; +ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384; EOF