Full_Name: Matthijs Mohlmann Version: 2.4.21 OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (83.163.247.203)
Hi,
The manpage about the TLS_CIPHER_SUITE is for gnutls a bit unclear, only an example for OpenSSL is provided.
Peter Marschall wrote a patch for this documentation issue.
See also: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510346 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=563113
Regards,
Matthijs Mohlmann
Patch: --- openldap-2.1.21/doc/man/man5/ldap.conf.5 +++ openldap-2.1.21/doc/man/man5/ldap.conf.5 2010-04-15 08:26:41.000000000 +0200 @@ -334,19 +334,37 @@ .B TLS_CIPHER_SUITE <cipher-suite-spec> Specifies acceptable cipher suite and preference order. <cipher-suite-spec> should be a cipher specification for OpenSSL, -e.g., HIGH:MEDIUM:+SSLv2. +<cipher-suite-spec> should be a cipher specification for OpenSSL resp. GNUtls. +Example: +.RS +.RS +.TP +.I OpenSSL: +TLS_CIPHER_SUITE HIGH:MEDIUM:+SSLv2 +.TP +.I GNUtls: +TLS_CIPHER_SUITE SECURE256:!AES-128-CBC +.RE
-To check what ciphers a given spec selects, use: +To check what ciphers a given spec selects in OpenSSL, use:
.nf openssl ciphers -v <cipher-suite-spec> .fi
-To obtain the list of ciphers in GNUtls use: +With GNUtls the available specs can be found in the manual page of +.BR gnutls-cli (1) +(see the description of the +option +.BR --priority ). + +In older versions of GNUtls, where gnutls-cli does not support the option +--priority, you can obtain the (em more limited (em list of ciphers by calling:
.nf - gnutls-cli -l + gnutls-cli -l .fi +.RE .TP .B TLS_RANDFILE <filename> Specifies the file to obtain random bits from when /dev/[u]random is