<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>
<div style="font-family: -webkit-standard;"><font face="Calibri">Hi,</font></div>
<div style="font-family: -webkit-standard;"><font face="Calibri"><br>
</font></div>
<div style="font-family: -webkit-standard;"><font face="Calibri">As part of securing our web interfaces, we wanted to disable client-initiated TLS renegotiation. </font></div>
<div style="font-family: -webkit-standard;"><font face="Calibri"><br>
</font></div>
<div style="font-family: -webkit-standard;"><font face="Calibri">The reasoning for this requirement <span style="color: rgb(51, 51, 51); background-color: rgb(255, 255, 255);">is as follows- </span></font><span style="color: rgb(51, 51, 51);"><font face="Calibri"><i>Generally,
renegotiation of TLS sessions is much more resource-intensive for the server than the client, and should therefore not be performed at will to avoid degrading performance. Disabling client from renegotiating secures the server from undergoing a DoS attack
due to continuous renegotiation requests.</i></font></span></div>
<div style="font-family: -webkit-standard;"><span style="color: rgb(51, 51, 51); font-family: Arial, sans-serif;"><br>
</span></div>
<div style="font-family: -webkit-standard;"><font color="#333333" face="Calibri">I</font><font face="Calibri"><span style="color: rgb(51, 51, 51); background-color: rgb(255, 255, 255);"> see that there is an option </span></font><font face="Calibri" style="font-size: 13px;"><b>SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION</b></font><span style="color: rgb(51, 51, 51); background-color: rgb(255, 255, 255); font-family: Calibri;">,
but that is to secure the renegotiation, not disable it.</span></div>
<div style="font-family: -webkit-standard;"><span style="color: rgb(51, 51, 51); background-color: rgb(255, 255, 255); font-family: Calibri;"><br>
</span></div>
<div style="font-family: -webkit-standard;"><font color="#333333" face="Calibri">I</font><span style="color: rgb(51, 51, 51); font-family: Calibri; background-color: rgb(255, 254, 254);"> wanted to check if there is a patch or flag available to disable any
negotiation initiated from the client side.</span></div>
<div style="font-family: -webkit-standard;"><span style="color: rgb(51, 51, 51); font-family: Calibri; background-color: rgb(255, 254, 254);"><br>
</span></div>
<div style="font-family: -webkit-standard;"><span style="color: rgb(51, 51, 51); font-family: Calibri; background-color: rgb(254, 253, 253);">Thanks and Regards,</span></div>
<div style="font-family: -webkit-standard;"><span style="color: rgb(51, 51, 51); font-family: Calibri; background-color: rgb(253, 252, 252);">Sashank</span></div>
</div>
</body>
</html>