Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-07 17:49:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

enhance(tls): use go's tls defaults (#38687)

Browse Source 
The hardcoded cipher suites and curve preferences date from 2021 and no
longer match what Go ships. All four `SSL_*` are now unset by default
which means "use Go's default".

1. TLS 1.3 is now the default instead of TLS 1.2.
2. Post-quantum key exchange (`X25519MLKEM768`) works.
3. Four `ECDHE-*-CBC-SHA` suites become negotiable on TLS 1.2.
This commit is contained in:
silverwind
2026-08-05 23:34:46 +02:00
committed by GitHub
parent 81551008d3
commit 42e0c9eca4
6 changed files with 165 additions and 142 deletions
Download Patch File Download Diff File Expand all files Collapse all files
custom/conf/app.example.ini
+8 -6
View File
@@ -112,15 +112,17 @@
;;
;; expect PROXY protocol header on connections to https redirector, defaults to USE_PROXY_PROTOCOL
;REDIRECTOR_USE_PROXY_PROTOCOL =
;; Minimum and maximum supported TLS versions
;SSL_MIN_VERSION=TLSv1.2
;; Minimum supported TLS version, one of TLSv1.0, TLSv1.1, TLSv1.2, TLSv1.3. Unset uses Go's default.
;SSL_MIN_VERSION=
;;
;; Maximum supported TLS version, one of TLSv1.0, TLSv1.1, TLSv1.2, TLSv1.3. Unset uses Go's default.
;SSL_MAX_VERSION=
;;
;; SSL Curve Preferences
;SSL_CURVE_PREFERENCES=X25519,P256
;; Comma-separated list of SSL curve preferences. Unset uses Go's default.
;SSL_CURVE_PREFERENCES=
;;
;; SSL Cipher Suites
;SSL_CIPHER_SUITES=; Will default to "ecdhe_ecdsa_with_aes_256_gcm_sha384,ecdhe_rsa_with_aes_256_gcm_sha384,ecdhe_ecdsa_with_aes_128_gcm_sha256,ecdhe_rsa_with_aes_128_gcm_sha256,ecdhe_ecdsa_with_chacha20_poly1305,ecdhe_rsa_with_chacha20_poly1305" if aes is supported by hardware, otherwise chacha will be first.
;; Comma-separated list of SSL cipher suites. Unset uses Go's default.
;SSL_CIPHER_SUITES=
;;
;; Timeout for any write to the connection. (Set to -1 to disable all timeouts.)
;PER_WRITE_TIMEOUT = 30s