gamzinav/haproxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

DOC: improve description of no-tls-tickets

Browse Source 
It was not obvious, that this setting only affects TLS versions <= 1.2 and it
we should also mention the security implication of session tickets here.

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
This commit is contained in:
Bjrn Jacke 2020-02-13 14:43:44 +01:00 committed by Willy Tarreau
parent 5ab7eb6860
commit 7b5e136458
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
doc/configuration.txt
View File

@ -11677,6 +11677,10 @@ no-tls-tickets
extension) and force to use stateful session resumption. Stateless
session resumption is more expensive in CPU usage. This option is also
available on global statement "ssl-default-bind-options".
The TLS ticket mechanism is only used up to TLS 1.2 and it is prone to
man-in-the-middle attacks. You should consider to disable them for
security reasons. TLS 1.3 implements more secure methods for session
resumption.
no-tlsv10
This setting is only available when support for OpenSSL was built in. It
@ -12376,6 +12380,10 @@ no-tls-tickets
extension) and force to use stateful session resumption. Stateless
session resumption is more expensive in CPU usage for servers. This option
is also available on global statement "ssl-default-server-options".
The TLS ticket mechanism is only used up to TLS 1.2 and it is prone to
man-in-the-middle attacks. You should consider to disable them for
security reasons. TLS 1.3 implements more secure methods for session
resumption.
See also "tls-tickets".
no-tlsv10