Dieter Klünter wrote: It already does, but you have to use the right cipher suites. Also see ITS #7595 http://www.openldap.org/its/index.cgi/Incoming?id=7595 -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

--On Friday, September 06, 2013 11:33 PM +0200 Michael Ströder <michael(a)stroeder.com&gt; wrote: The latter is correct. Can you file a doc bug? --Quanah -- Quanah Gibson-Mount Lead Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

Michael Ströder wrote: This was noted in ITS#7506. Apparently no one considered it an important enough issue to fix it in the meantime. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

Nachricht <522A4A3A.9060401(a)stroeder.com&gt;: Please let me note that 'TLSDHParamFile' is just a terrible identifier. How large is the fine for using underscores like in 'TLS_DH_ParamFile'? ;-)

Howard Chu wrote: Please correct if I'm wrong. But this ITS seems to be about using the cipher suites based on elliptic curves with EC server key/cert. But what about just the DHE-RSA cipher suites like DHE-RSA-AES256-SHA for TLSv1 with RSA-based server key/cert? Why does Apache support this out-of-the-box and OpenLDAP 2.4.36 does not? Do I have to configure something else? Ciao, Michael.

Dieter Klünter wrote: Hmm... Tests on my local system (with OpenSSL 1.0.1e shipped with distribution) using sslscan with no cipher configuration directives in the server configurations (only listing the "Accepted"). OpenLDAP RE24 build: Supported Server Cipher(s): Accepted TLSv1 256 bits AES256-SHA Accepted TLSv1 256 bits CAMELLIA256-SHA Accepted TLSv1 168 bits DES-CBC3-SHA Accepted TLSv1 128 bits AES128-SHA Accepted TLSv1 128 bits SEED-SHA Accepted TLSv1 128 bits CAMELLIA128-SHA Accepted TLSv1 128 bits RC4-SHA Accepted TLSv1 128 bits RC4-MD5 Accepted TLSv1 56 bits DES-CBC-SHA Accepted TLSv1 40 bits EXP-DES-CBC-SHA Accepted TLSv1 40 bits EXP-RC2-CBC-MD5 Accepted TLSv1 40 bits EXP-RC4-MD5 Accepted TLSv1.1 256 bits AES256-SHA Accepted TLSv1.1 256 bits CAMELLIA256-SHA Accepted TLSv1.1 168 bits DES-CBC3-SHA Accepted TLSv1.1 128 bits AES128-SHA Accepted TLSv1.1 128 bits SEED-SHA Accepted TLSv1.1 128 bits CAMELLIA128-SHA Accepted TLSv1.1 128 bits RC4-SHA Accepted TLSv1.1 128 bits RC4-MD5 Accepted TLSv1.1 56 bits DES-CBC-SHA Accepted TLSv1.1 40 bits EXP-DES-CBC-SHA Accepted TLSv1.1 40 bits EXP-RC2-CBC-MD5 Accepted TLSv1.1 40 bits EXP-RC4-MD5 Accepted TLSv1.2 256 bits AES256-GCM-SHA384 Accepted TLSv1.2 256 bits AES256-SHA256 Accepted TLSv1.2 256 bits AES256-SHA Accepted TLSv1.2 256 bits CAMELLIA256-SHA Accepted TLSv1.2 168 bits DES-CBC3-SHA Accepted TLSv1.2 128 bits AES128-GCM-SHA256 Accepted TLSv1.2 128 bits AES128-SHA256 Accepted TLSv1.2 128 bits AES128-SHA Accepted TLSv1.2 128 bits SEED-SHA Accepted TLSv1.2 128 bits CAMELLIA128-SHA Accepted TLSv1.2 128 bits RC4-SHA Accepted TLSv1.2 128 bits RC4-MD5 Accepted TLSv1.2 56 bits DES-CBC-SHA Accepted TLSv1.2 40 bits EXP-DES-CBC-SHA Accepted TLSv1.2 40 bits EXP-RC2-CBC-MD5 Accepted TLSv1.2 40 bits EXP-RC4-MD5 Apache web server: Supported Server Cipher(s): Accepted TLSv1 256 bits DHE-RSA-AES256-SHA Accepted TLSv1 256 bits DHE-RSA-CAMELLIA256-SHA Accepted TLSv1 256 bits AES256-SHA Accepted TLSv1 256 bits CAMELLIA256-SHA Accepted TLSv1 168 bits EDH-RSA-DES-CBC3-SHA Accepted TLSv1 168 bits DES-CBC3-SHA Accepted TLSv1 128 bits DHE-RSA-AES128-SHA Accepted TLSv1 128 bits DHE-RSA-SEED-SHA Accepted TLSv1 128 bits DHE-RSA-CAMELLIA128-SHA Accepted TLSv1 128 bits AES128-SHA Accepted TLSv1 128 bits SEED-SHA Accepted TLSv1 128 bits CAMELLIA128-SHA Accepted TLSv1 128 bits RC4-SHA Accepted TLSv1 128 bits RC4-MD5 Accepted TLSv1 56 bits EDH-RSA-DES-CBC-SHA Accepted TLSv1 56 bits DES-CBC-SHA Accepted TLSv1 40 bits EXP-EDH-RSA-DES-CBC-SHA Accepted TLSv1 40 bits EXP-DES-CBC-SHA Accepted TLSv1 40 bits EXP-RC2-CBC-MD5 Accepted TLSv1 40 bits EXP-RC4-MD5 Accepted TLSv1.1 256 bits DHE-RSA-AES256-SHA Accepted TLSv1.1 256 bits DHE-RSA-CAMELLIA256-SHA Accepted TLSv1.1 256 bits AES256-SHA Accepted TLSv1.1 256 bits CAMELLIA256-SHA Accepted TLSv1.1 168 bits EDH-RSA-DES-CBC3-SHA Accepted TLSv1.1 168 bits DES-CBC3-SHA Accepted TLSv1.1 128 bits DHE-RSA-AES128-SHA Accepted TLSv1.1 128 bits DHE-RSA-SEED-SHA Accepted TLSv1.1 128 bits DHE-RSA-CAMELLIA128-SHA Accepted TLSv1.1 128 bits AES128-SHA Accepted TLSv1.1 128 bits SEED-SHA Accepted TLSv1.1 128 bits CAMELLIA128-SHA Accepted TLSv1.1 128 bits RC4-SHA Accepted TLSv1.1 128 bits RC4-MD5 Accepted TLSv1.1 56 bits EDH-RSA-DES-CBC-SHA Accepted TLSv1.1 56 bits DES-CBC-SHA Accepted TLSv1.1 40 bits EXP-EDH-RSA-DES-CBC-SHA Accepted TLSv1.1 40 bits EXP-DES-CBC-SHA Accepted TLSv1.1 40 bits EXP-RC2-CBC-MD5 Accepted TLSv1.1 40 bits EXP-RC4-MD5 Accepted TLSv1.2 256 bits DHE-RSA-AES256-GCM-SHA384 Accepted TLSv1.2 256 bits DHE-RSA-AES256-SHA256 Accepted TLSv1.2 256 bits DHE-RSA-AES256-SHA Accepted TLSv1.2 256 bits DHE-RSA-CAMELLIA256-SHA Accepted TLSv1.2 256 bits AES256-GCM-SHA384 Accepted TLSv1.2 256 bits AES256-SHA256 Accepted TLSv1.2 256 bits AES256-SHA Accepted TLSv1.2 256 bits CAMELLIA256-SHA Accepted TLSv1.2 168 bits EDH-RSA-DES-CBC3-SHA Accepted TLSv1.2 168 bits DES-CBC3-SHA Accepted TLSv1.2 128 bits DHE-RSA-AES128-GCM-SHA256 Accepted TLSv1.2 128 bits DHE-RSA-AES128-SHA256 Accepted TLSv1.2 128 bits DHE-RSA-AES128-SHA Accepted TLSv1.2 128 bits DHE-RSA-SEED-SHA Accepted TLSv1.2 128 bits DHE-RSA-CAMELLIA128-SHA Accepted TLSv1.2 128 bits AES128-GCM-SHA256 Accepted TLSv1.2 128 bits AES128-SHA256 Accepted TLSv1.2 128 bits AES128-SHA Accepted TLSv1.2 128 bits SEED-SHA Accepted TLSv1.2 128 bits CAMELLIA128-SHA Accepted TLSv1.2 128 bits RC4-SHA Accepted TLSv1.2 128 bits RC4-MD5 Accepted TLSv1.2 56 bits EDH-RSA-DES-CBC-SHA Accepted TLSv1.2 56 bits DES-CBC-SHA Accepted TLSv1.2 40 bits EXP-EDH-RSA-DES-CBC-SHA Accepted TLSv1.2 40 bits EXP-DES-CBC-SHA Accepted TLSv1.2 40 bits EXP-RC2-CBC-MD5 Accepted TLSv1.2 40 bits EXP-RC4-MD5 Any reason why the *DHE* ciphers seems not to be supported during OpenLDAP scan which they are with Apache on the very same system? Ciao, Michael.

Philip Guenther wrote: Oh yeah, TLSDHParamFile /dev/null did the trick. Thanks. And also invoking openssl dhparam -out /etc/openldap/ssl.key/dhparam 2048 and setting TLSDHParamFile /etc/openldap/ssl.key/dhparam Ciao, Michael.