The TLS_ECDHE_* ciphers will automatically be used be the proxy
as they are in the HIGH ciphersuite.
---
PVE/HTTPServer.pm | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/PVE/HTTPServer.pm b/PVE/HTTPServer.pm
index 1e27bba..e38542b 100755
--- a/PVE/HTTPServer.pm
+++ b/PVE/HTTPServer.pm
@@ -1625,6 +1625,13 @@ sub new {
if ($self->{ssl}) {
$self->{tls_ctx} = AnyEvent::TLS->new(%{$self->{ssl}});
Net::SSLeay::CTX_set_options($self->{tls_ctx}->{ctx},
&Net::SSLeay::OP_NO_COMPRESSION);
+ # ECDH curve ( Net-SSLeay >= 1.56, openssl >= 1.0.0 )
+ if ( exists &Net::SSLeay::CTX_set_tmp_ecdh ) {
+ my $curve = Net::SSLeay::OBJ_txt2nid('prime256v1');
+ my $ecdh = Net::SSLeay::EC_KEY_new_by_curve_name($curve);
+ Net::SSLeay::CTX_set_tmp_ecdh( $self->{tls_ctx}->{ctx}, $ecdh );
+ Net::SSLeay::EC_KEY_free($ecdh);
+ }
}
if ($self->{spiceproxy}) {
--
2.7.4
_______________________________________________
pve-devel mailing list
pve-devel@pve.proxmox.com
http://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
