TLSv1 on CentOS-8

[Viktor Dukhovni]

On Fri, Apr 17, 2020 at 05:17:47PM +0200, Tomas Mraz wrote:

> Or you could modify the /etc/pki/tls/openssl.cnf:
> Find the .include /etc/crypto-policies/back-ends/opensslcnf.config
> line in it and insert something like:
> 
> CipherString = @SECLEVEL=1:kEECDH:kRSA:kEDH:kPSK:kDHEPSK:kECDHEPSK:!DES:!RC2:!RC4:!IDEA:-SEED:!eNULL:!aNULL:!MD5:-SHA384:-CAMELLIA:-ARIA:-AESCCM8

How did this particular contraption become a recommended cipherlist?
What's wrong with "DEFAULT"?  In OpenSSL 1.1.1 it already excludes
RC4 (if RC4 is at all enabled at compile time):

    $ openssl ciphers -v 'COMPLEMENTOFDEFAULT+RC4'
    ECDHE-ECDSA-RC4-SHA     TLSv1 Kx=ECDH     Au=ECDSA Enc=RC4(128) Mac=SHA1
    ECDHE-RSA-RC4-SHA       TLSv1 Kx=ECDH     Au=RSA  Enc=RC4(128)  Mac=SHA1
    RC4-SHA                 SSLv3 Kx=RSA      Au=RSA  Enc=RC4(128)  Mac=SHA1

I find too many people cargo-culting poorly thought cipher lists from
some random HOWTO.  Over optimising your cipherlist is subject to
rapid bitrot, resist the temptation...

-- 
    Viktor.