Skip to content

Make CE HTTPS use current Mozilla recommendations #4568

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Sep 12, 2024
Merged

Make CE HTTPS use current Mozilla recommendations #4568

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
b7d2805
allow configurable cipher suites in CE
ruslandoga Sep 11, 2024
ad2c7da
just use intermediate compatibility
ruslandoga Sep 11, 2024
e61c7e5
configure eccs like mozilla
ruslandoga Sep 11, 2024
f6ed479
Merge branch 'master' into allow-configurable-cipher-suites
ruslandoga Sep 11, 2024
16f84d2
drop ciphers with rsa
ruslandoga Sep 11, 2024
77a380a
Merge branch 'master' into allow-configurable-cipher-suites
ruslandoga Sep 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 24 additions & 6 deletions config/runtime.exs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -329,12 +329,30 @@ config :plausible, PlausibleWeb.Endpoint,
# maybe enable HTTPS in CE
if config_env() in [:ce, :ce_dev, :ce_test] do
if https_port do
https_opts = [
port: https_port,
ip: listen_ip,
cipher_suite: :compatible,
Copy link
Contributor Author

@ruslandoga ruslandoga Sep 11, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Plug's compatible cipher suite is a bit outdated: elixir-plug/plug#1143

transport_options: [socket_opts: [log_level: :warning]]
]
# the following configuration is based on https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28recommended.29
# except we enforce the cipher and ecc order and only use ciphers with support
# for ecdsa certificates since that's what certbot generates by default
https_opts =
[
port: https_port,
ip: listen_ip,
transport_options: [socket_opts: [log_level: :warning]],
versions: [:"tlsv1.2", :"tlsv1.3"],
honor_cipher_order: true,
honor_ecc_order: true,
eccs: [:x25519, :secp256r1, :secp384r1],
supported_groups: [:x25519, :secp256r1, :secp384r1],
ciphers: [
# Mozilla recommended cipher suites (TLS 1.3)
~c"TLS_AES_128_GCM_SHA256",
~c"TLS_AES_256_GCM_SHA384",
~c"TLS_CHACHA20_POLY1305_SHA256",
# Mozilla recommended cipher suites (TLS 1.2)
~c"ECDHE-ECDSA-AES128-GCM-SHA256",
~c"ECDHE-ECDSA-AES256-GCM-SHA384",
~c"ECDHE-ECDSA-CHACHA20-POLY1305"
]
]

https_opts = Config.Reader.merge(default_http_opts, https_opts)
config :plausible, PlausibleWeb.Endpoint, https: https_opts
Expand Down