diff options
| author | Heiko Schlittermann (HS12-RIPE) <hs@schlittermann.de> | 2016-12-02 14:32:08 +0100 |
|---|---|---|
| committer | Heiko Schlittermann (HS12-RIPE) <hs@schlittermann.de> | 2016-12-04 22:04:00 +0100 |
| commit | 8e53a4fc1a0790138a5b460da7d9c621f6d32622 (patch) | |
| tree | 2ef9a3cdea4bc54d25fbd98b8d7ffd77f227fbbd /doc | |
| parent | dc8ae77b80164fe6abf7f55c8deffcfc91c2aebf (diff) | |
OpenSSL: default to tls_eccurve = auto
For OpenSSL < 1.0.2: fallback to prime256v1, for newer libraries
rely on auto-selection.
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/doc-docbook/spec.xfpt | 18 | ||||
| -rw-r--r-- | doc/doc-txt/ChangeLog | 2 |
2 files changed, 12 insertions, 8 deletions
diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt index c3fc1fb21..ce64fd405 100644 --- a/doc/doc-docbook/spec.xfpt +++ b/doc/doc-docbook/spec.xfpt @@ -17139,17 +17139,19 @@ prior to the 4.80 release, as Debian used to patch Exim to raise the minimum acceptable bound from 1024 to 2048. -.option tls_eccurve main string&!! prime256v1 +.option tls_eccurve main string&!! &`auto`& .cindex TLS "EC cryptography" -If built with a recent-enough version of OpenSSL, -this option selects a EC curve for use by Exim. +This option selects a EC curve for use by Exim. -Curve names of the form &'prime256v1'& are accepted. -For even more-recent library versions, names of the form &'P-512'& -are also accepted, plus the special value &'auto'& -which tells the library to choose. +After expansion it must contain a valid EC curve parameter, such as +&`prime256v1`&, &`secp384r1`&, or &`P-512`&. Consult your OpenSSL manual +for valid selections. -If the option is set to an empty string, no EC curves will be enabled. +For OpenSSL versions before (and not including) 1.0.2, the string +&`auto`& selects &`prime256v1`&. For more recent OpenSSL versions +&`auto`& tells the library to choose. + +If the option expands to an empty string, no EC curves will be enabled. .option tls_ocsp_file main string&!! unset diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog index 6532b1ced..156413fcd 100644 --- a/doc/doc-txt/ChangeLog +++ b/doc/doc-txt/ChangeLog @@ -140,6 +140,8 @@ HS/01 Fix leak in verify callout under GnuTLS, about 3MB per recipient on HS/02 Bug 1802: Do not half-close the connection after sending a request to rspamd. +HS/03 Use "auto" as the default EC curve parameter. For OpenSSL < 1.0.2 + fallback to "prime256v1". Exim version 4.87 ----------------- |