RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2025-04-11 03:31:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

DOC: improve description of no-tls-tickets

Browse Source 
It was not obvious, that this setting only affects TLS versions <= 1.2 and it
we should also mention the security implication of session tickets here.

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
This commit is contained in:
Bj�rn Jacke 2020-02-13 14:43:44 +01:00 committed by Willy Tarreau
parent 5ab7eb6860
commit 7b5e136458
1 changed files with 8 additions and 0 deletions

8
doc/configuration.txt
View File

@ -11677,6 +11677,10 @@ no-tls-tickets
extension) and force to use stateful session resumption. Stateless extension) and force to use stateful session resumption. Stateless
session resumption is more expensive in CPU usage. This option is also session resumption is more expensive in CPU usage. This option is also
available on global statement "ssl-default-bind-options". available on global statement "ssl-default-bind-options".
The TLS ticket mechanism is only used up to TLS 1.2 and it is prone to
man-in-the-middle attacks. You should consider to disable them for
security reasons. TLS 1.3 implements more secure methods for session
resumption.
no-tlsv10 no-tlsv10
This setting is only available when support for OpenSSL was built in. It This setting is only available when support for OpenSSL was built in. It
@ -12376,6 +12380,10 @@ no-tls-tickets
extension) and force to use stateful session resumption. Stateless extension) and force to use stateful session resumption. Stateless
session resumption is more expensive in CPU usage for servers. This option session resumption is more expensive in CPU usage for servers. This option
is also available on global statement "ssl-default-server-options". is also available on global statement "ssl-default-server-options".
The TLS ticket mechanism is only used up to TLS 1.2 and it is prone to
man-in-the-middle attacks. You should consider to disable them for
security reasons. TLS 1.3 implements more secure methods for session
resumption.
See also "tls-tickets". See also "tls-tickets".
no-tlsv10 no-tlsv10