- mitigate against BEAST attacks, see https://redmine.lighttpd.net/issues/2364

Changed files:
    lighttpd-ssl.conf -> 1.4

diff --git a/lighttpd-ssl.conf b/lighttpd-ssl.conf
index 329c32b424488af5a9460d5fc202e853f25b5dcf..aabab2120366f71fab2b4e8225f46aef7612b14d 100644 (file)
--- a/lighttpd-ssl.conf
+++ b/lighttpd-ssl.conf
@@ -2,6 +2,10 @@
 #
 # Documentation: http://redmine.lighttpd.net/projects/lighttpd/wiki/Docs:SSL
 
+# mitigate against BEAST attacks
+# http://blog.ivanristic.com/2011/10/mitigating-the-beast-attack-on-tls.html
+#ssl.cipher-list = "ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4-SHA:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM"
+
 $SERVER["socket"] == ":443" {
        ssl.engine = "enable"
        ssl.pemfile = "/etc/lighttpd/server.pem"