From 1728bf0873590c6905e892044f9f87ee97ff3dbc Mon Sep 17 00:00:00 2001 From: Philip Kaufmann Date: Thu, 17 Oct 2013 16:11:25 +0200 Subject: [PATCH] update default -rpcsslciphers to include TLSv1.2 - this extends the accepted ciphersuites with TLSv1.2 ones - also removes !AH, as I could not find documentation on it and the change did not result in a changed ciphersuite list (checked via openssl ciphers -v) - closes #3096 (which also contains more details) --- src/bitcoinrpc.cpp | 2 +- src/init.cpp | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/bitcoinrpc.cpp b/src/bitcoinrpc.cpp index 798660dff3..2a9ced509c 100644 --- a/src/bitcoinrpc.cpp +++ b/src/bitcoinrpc.cpp @@ -809,7 +809,7 @@ void StartRPCThreads() if (filesystem::exists(pathPKFile)) rpc_ssl_context->use_private_key_file(pathPKFile.string(), ssl::context::pem); else LogPrintf("ThreadRPCServer ERROR: missing server private key file %s\n", pathPKFile.string().c_str()); - string strCiphers = GetArg("-rpcsslciphers", "TLSv1+HIGH:!SSLv2:!aNULL:!eNULL:!AH:!3DES:@STRENGTH"); + string strCiphers = GetArg("-rpcsslciphers", "TLSv1.2+HIGH:TLSv1+HIGH:!SSLv2:!aNULL:!eNULL:!3DES:@STRENGTH"); SSL_CTX_set_cipher_list(rpc_ssl_context->impl(), strCiphers.c_str()); } diff --git a/src/init.cpp b/src/init.cpp index 28ec409bae..48f4a0d006 100644 --- a/src/init.cpp +++ b/src/init.cpp @@ -258,7 +258,7 @@ std::string HelpMessage() strUsage += " -rpcssl " + _("Use OpenSSL (https) for JSON-RPC connections") + "\n"; strUsage += " -rpcsslcertificatechainfile= " + _("Server certificate file (default: server.cert)") + "\n"; strUsage += " -rpcsslprivatekeyfile= " + _("Server private key (default: server.pem)") + "\n"; - strUsage += " -rpcsslciphers= " + _("Acceptable ciphers (default: TLSv1+HIGH:!SSLv2:!aNULL:!eNULL:!AH:!3DES:@STRENGTH)") + "\n"; + strUsage += " -rpcsslciphers= " + _("Acceptable ciphers (default: TLSv1.2+HIGH:TLSv1+HIGH:!SSLv2:!aNULL:!eNULL:!3DES:@STRENGTH)") + "\n"; return strUsage; }