Skip to content

fix: Removes weak ciphers from https_server defaults #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gl-agnx merged 1 commit into from
May 25, 2026
Merged

fix: Removes weak ciphers from https_server defaults #13

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 3 additions & 10 deletions applications/https_server/main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -172,9 +172,8 @@ static const char *DEFAULT_ALPN_PROTOCOLS[] = { "http/1.1", "h2" };
static const uint32_t DEFAULT_ALPN_PROTOCOL_COUNT =
(uint32_t)(sizeof(DEFAULT_ALPN_PROTOCOLS) / sizeof(DEFAULT_ALPN_PROTOCOLS[0]));
/*
* Default TLS 1.2 offer: forward-secret AEAD first (no static RSA key exchange, no 3DES).
* Weak CBC/SHA1 ECDHE/DHE-RSA suites are appended last for tlsfuzzer scripts that pin only
* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA / TLS_DHE_RSA_WITH_AES_128_CBC_SHA (e.g. test_sig_algs.py).
* Default TLS 1.2 offer: forward-secret AEAD only (no static RSA key exchange, no 3DES, no CBC/SHA1).
* Scripts that require legacy CBC suites (e.g. tlsfuzzer test_sig_algs.py) can pass --cipher-suites.
*/
static const uint16_t TLS12_FALLBACK_DEFAULT_SUITES[] = {
TLS_CIPHER_SUITE_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
Expand All @@ -190,13 +189,7 @@ static const uint16_t TLS12_FALLBACK_DEFAULT_SUITES[] = {
TLS_CIPHER_SUITE_ECDHE_ECDSA_WITH_AES_128_CCM,
TLS_CIPHER_SUITE_ECDHE_ECDSA_WITH_AES_256_CCM,
TLS_CIPHER_SUITE_ECDHE_ECDSA_WITH_AES_128_CCM_8,
TLS_CIPHER_SUITE_ECDHE_ECDSA_WITH_AES_256_CCM_8,
/*
* tlsfuzzer test_sig_algs.py (and similar probes) pin TLS_ECDHE/DHE_RSA_WITH_AES_128_CBC_SHA only.
* Keep these after AEAD so normal clients still negotiate forward-secret AEAD first.
*/
TLS_CIPHER_SUITE_ECDHE_RSA_WITH_AES_128_CBC_SHA,
TLS_CIPHER_SUITE_DHE_RSA_WITH_AES_128_CBC_SHA
TLS_CIPHER_SUITE_ECDHE_ECDSA_WITH_AES_256_CCM_8
};

typedef struct {
Expand Down
Loading