Skip to content

Commit

Permalink
Use nginx default value for SSLECDHCurve
Browse files Browse the repository at this point in the history
This configuration setting permits nginx to auto discover supported curves based on what openssl was compiled with. With the old default of secp384r1 if you attempted to use a key from a different curve, for example prime256v1, the SSL handshake would fail in an awful way without any helpful errors logged anywhere.

The default setting in nginx has been "auto" since 1.11.0
  • Loading branch information
bobveznat authored Sep 21, 2017
1 parent 37bd14d commit 045ccea
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion controllers/nginx/pkg/config/config.go
Original file line number Diff line number Diff line change
Expand Up @@ -411,7 +411,7 @@ func NewDefault() Configuration {
ShowServerTokens: true,
SSLBufferSize: sslBufferSize,
SSLCiphers: sslCiphers,
SSLECDHCurve: "secp384r1",
SSLECDHCurve: "auto",
SSLProtocols: sslProtocols,
SSLSessionCache: true,
SSLSessionCacheSize: sslSessionCacheSize,
Expand Down

0 comments on commit 045ccea

Please sign in to comment.