@@ -102,7 +102,7 @@ data TLSSettings = TLSSettings {
102102 -- ^ The TLS ciphers this server accepts.
103103 --
104104 -- >>> tlsCiphers defaultTlsSettings
105− -- [ECDHE-RSA-AES128GCM-SHA256,DHE-RSA-AES128GCM-SHA256,DHE-RSA-AES256-SHA256,DHE-RSA-AES128-SHA256,DHE-RSA-AES256-SHA1,DHE-RSA-AES128-SHA1,DHE-DSA-AES128-SHA1,DHE-DSA-AES256-SHA1,RSA-aes128-sha1,RSA-aes256-sha1]
105+ -- [ECDHE-ECDSA-AES256GCM-SHA384,ECDHE-ECDSA-AES128GCM-SHA256,ECDHE-RSA-AES256GCM-SHA384,ECDHE-RSA-AES128GCM-SHA256,DHE-RSA-AES256GCM-SHA384,DHE-RSA-AES128GCM-SHA256,ECDHE-ECDSA-AES256CBC-SHA384,ECDHE-RSA-AES256CBC-SHA384,DHE-RSA-AES256-SHA256,ECDHE-ECDSA-AES256CBC-SHA,ECDHE-RSA-AES256CBC-SHA,DHE-RSA-AES256-SHA1,RSA-AES256GCM-SHA384,RSA-AES256-SHA256,RSA-AES256-SHA1]
106106 --
107107 -- Since 1.4.2
108108 , tlsWantClientCert :: Bool
@@ -151,20 +151,7 @@ defaultTlsSettings = TLSSettings {
151151
152152-- taken from stunnel example in tls-extra
153153ciphers :: [TLS.Cipher]
154−ciphers =
155− [ TLSExtra.cipher_ECDHE_RSA_AES128GCM_SHA256
156− , TLSExtra.cipher_ECDHE_RSA_AES128CBC_SHA256
157− , TLSExtra.cipher_ECDHE_RSA_AES128CBC_SHA
158− , TLSExtra.cipher_DHE_RSA_AES128GCM_SHA256
159− , TLSExtra.cipher_DHE_RSA_AES256_SHA256
160− , TLSExtra.cipher_DHE_RSA_AES128_SHA256
161− , TLSExtra.cipher_DHE_RSA_AES256_SHA1
162− , TLSExtra.cipher_DHE_RSA_AES128_SHA1
163− , TLSExtra.cipher_DHE_DSS_AES128_SHA1
164− , TLSExtra.cipher_DHE_DSS_AES256_SHA1
165− , TLSExtra.cipher_AES128_SHA1
166− , TLSExtra.cipher_AES256_SHA1
167− ]
154+ciphers = TLSExtra.ciphersuite_strong
168155
169156----------------------------------------------------------------
170157
@@ -279,14 +266,6 @@ runTLSSocket' tlsset@TLSSettings{..} set credential sock app =
279266 TLS.supportedVersions = tlsAllowedVersions
280267 , TLS.supportedCiphers = tlsCiphers
281268 , TLS.supportedCompressions = [TLS.nullCompression]
282− , TLS.supportedHashSignatures = [
283− -- Safari 8 and go tls have bugs on SHA 512 and SHA 384.
284− -- So, we don't specify them here at this moment.
285− (TLS.HashSHA256, TLS.SignatureRSA)
286− , (TLS.HashSHA224, TLS.SignatureRSA)
287− , (TLS.HashSHA1, TLS.SignatureRSA)
288− , (TLS.HashSHA1, TLS.SignatureDSS)
289− ]
290269 , TLS.supportedSecureRenegotiation = True
291270 , TLS.supportedClientInitiatedRenegotiation = False
292271 , TLS.supportedSession = True