Skip to content

Commit

Permalink
Add AES256-GCM-SHA384 to the allowed SSL ciphers.
Browse files Browse the repository at this point in the history
AWS's Clasic ELB health check tool requires this cipher in order to
proxy to Chef Server nodes.
  • Loading branch information
ryancragun committed Nov 8, 2016
1 parent da2cc8f commit 434aa92
Showing 1 changed file with 1 addition and 1 deletion.
Original file line number Diff line number Diff line change
Expand Up @@ -469,7 +469,7 @@
# Based off of the Mozilla recommended cipher suite
# https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=nginx-1.8.1&openssl=1.0.1u&hsts=no&profile=modern
default['private_chef']['nginx']['ssl_protocols'] = "TLSv1.2"
default['private_chef']['nginx']['ssl_ciphers'] = "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:!aNULL:!eNULL:!EXPORT"
default['private_chef']['nginx']['ssl_ciphers'] = "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT"
#
# The SSL Certificate and DH Param will be automatically generated if
# these are nil. Otherwise we expect these attributes to point at the
Expand Down

0 comments on commit 434aa92

Please sign in to comment.