Re: PFS Ciphers

Emmanuel Dreyfus wrote:

Hi

I tried to use ciphers that bring PFS for OpenLDAP, but it did not work. I used this cipher specification:

TLSCipherSuite ECDH:DH:!SHA:!MD5:!aNULL:!eNULL

I test it this way: for i in `openssl ciphers ALL|tr ':' '\n'` ; do echo ''|openssl s_client -cipher $i -connect server:636 \ 2>/dev/null |awk '/ Cipher/{print }' ; done

I get nothing. I understand ECDH needs some support code, but why aren't DH ciphers available?

Read the slapd.conf(5) or slapd-config(5) manpage. You must configure the TLSDHParamFile.

Your ciphersuite is wrong anyway. You want DHE, not DH, for PFS.