tree 6a9c46dd5f2756661cc917c42cb27c38296d4891
parent ff9f7698fcefef66bceb1ec32a3da8b14947a594
author David BERARD <contact@davidberard.fr> 1346764513 +0200
committer Willy Tarreau <w@1wt.eu> 1346765732 +0200

MEDIUM: ssl: add support for prefer-server-ciphers option

I wrote a small path to add the SSL_OP_CIPHER_SERVER_PREFERENCE OpenSSL option
to frontend, if the 'prefer-server-ciphers' keyword is set.

Example :
	bind 10.11.12.13 ssl /etc/haproxy/ssl/cert.pem ciphers RC4:HIGH:!aNULL:!MD5 prefer-server-ciphers

This option mitigate the effect of the BEAST Attack (as I understand), and it
equivalent to :
	- Apache HTTPd SSLHonorCipherOrder option.
	- Nginx ssl_prefer_server_ciphers option.

[WT: added a test for the support of the option]