diff options
| -rw-r--r-- | ansible/group_vars/all/haproxy.yml | 16 | ||||
| -rw-r--r-- | releasenotes/notes/harden_haproxy_tls_config-edeea2ed54316bad.yaml | 7 |
2 files changed, 19 insertions, 4 deletions
diff --git a/ansible/group_vars/all/haproxy.yml b/ansible/group_vars/all/haproxy.yml index c96e6e408..57ce83df8 100644 --- a/ansible/group_vars/all/haproxy.yml +++ b/ansible/group_vars/all/haproxy.yml @@ -50,24 +50,32 @@ _ssl_intermediate_ciphersuites: - TLS_AES_256_GCM_SHA384 - TLS_CHACHA20_POLY1305_SHA256 +_ssl_intermediate_options: + - ssl-min-ver TLSv1.2 + - no-tls-tickets + _ssl_modern_ciphersuites: - TLS_AES_128_GCM_SHA256 - TLS_AES_256_GCM_SHA384 - TLS_CHACHA20_POLY1305_SHA256 +_ssl_modern_options: + - ssl-min-ver TLSv1.3 + - no-tls-tickets + ssl_intermediate_settings: | ssl-default-bind-ciphers {{ _ssl_intermediate_ciphers | join(':') }} ssl-default-bind-ciphersuites {{ _ssl_intermediate_ciphersuites | join(':') }} - ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets + ssl-default-bind-options {{ (['prefer-client-ciphers'] + _ssl_intermediate_options) | join(' ') }} ssl-default-server-ciphers {{ _ssl_intermediate_ciphers | join(':') }} ssl-default-server-ciphersuites {{ _ssl_intermediate_ciphersuites | join(':') }} - ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets + ssl-default-server-options {{ _ssl_intermediate_options | join(' ') }} ssl_modern_settings: | ssl-default-bind-ciphersuites {{ _ssl_modern_ciphersuites | join(':') }} - ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets + ssl-default-bind-options {{ (['prefer-client-ciphers'] + _ssl_modern_options) | join(' ') }} ssl-default-server-ciphersuites {{ _ssl_modern_ciphersuites | join(':') }} - ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets + ssl-default-server-options {{ _ssl_modern_options | join(' ') }} haproxy_stats_port: "1984" haproxy_monitor_port: "61313" diff --git a/releasenotes/notes/harden_haproxy_tls_config-edeea2ed54316bad.yaml b/releasenotes/notes/harden_haproxy_tls_config-edeea2ed54316bad.yaml new file mode 100644 index 000000000..1adcdcec1 --- /dev/null +++ b/releasenotes/notes/harden_haproxy_tls_config-edeea2ed54316bad.yaml @@ -0,0 +1,7 @@ +--- +features: + - | + Harden the HAProxy TLS configuration according to Mozilla SSL + recommendations for HAProxy 2.8.15 and OpenSSL 3.x + (Rocky Linux and Ubuntu): + `<https://ssl-config.mozilla.org/#server=haproxy&version=2.8.15&config=modern&openssl=3.0.13&guideline=5.7>`__ |