From 61c5a2b151cfc7e338cc24234b9389940a3ef4a5 Mon Sep 17 00:00:00 2001 From: "Zsolt Gyulai (zgyulai)" Date: Mon, 15 Jan 2024 12:25:38 +0100 Subject: [PATCH] added openssl-conf-cmds() and ocsp-stapling-verify() options Signed-off-by: Zsolt Gyulai (zgyulai) --- .../syslog-ng-guide-admin/tlsoptions.htm | 73 +++++++++++++++++++ 1 file changed, 73 insertions(+) diff --git a/Content/Guides/syslog-ng-guide-admin/tlsoptions.htm b/Content/Guides/syslog-ng-guide-admin/tlsoptions.htm index 0340bfa83..21a688142 100644 --- a/Content/Guides/syslog-ng-guide-admin/tlsoptions.htm +++ b/Content/Guides/syslog-ng-guide-admin/tlsoptions.htm @@ -198,6 +198,79 @@
keylog-file()
+ +
+
ocsp-stapling-verify()
+ + + + + + + + + + + + + + + + + +
Accepted values:yes, no
Default:no
+

This option is available in 4.0 and later versions.

+

Description: In case the OCSP stapling verification is enabled request the server to return its OCSP status. This status response is verified by using the trust store configured by the ca-file(), ca-dir(), or the pkcs12-file() options.

+
+

NOTE: RFC 6961 multi-stapling and TLS 1.3-provided multiple responses are currently not validated, only the peer certificate is verified.

+
+
+
Example:
+ 
destination {
+
+    network("example.com" transport(tls)
+        tls(
+            pkcs12-file("/path/to/test.p12")
+            peer-verify(yes)
+            ocsp-stapling-verify(yes)
+        )
+    );
+};
+
+
+
+
+
openssl-conf-cmds()
+ + + + +

This option is available in 4.0 and later versions.

+
+

NOTE: openssl-conf-cmds() always has the highest priority. It overrides any other option found in the tls() section.

+
+

OpenSSL offers an alternative and software-independent configuration mechanism through the SSL_CONF_cmd interface for configuring the various SSL_CTX and SSL options.

+

The order of operations within openssl-conf-cmds() affects the order of execution. The commands are executed in top-down order. If the same option occurs multiple times, the last executed option takes effect. This is also true for options that can be set multiple ways (for example, cipher suites or protocols).

+
+
Example:
+ 
    tls(
+        ca-dir("/etc/ca.d")
+        key-file("/etc/cert.d/serverkey.pem")
+        cert-file("/etc/cert.d/servercert.pem")
+        peer-verify(yes)
+
+        openssl-conf-cmds(
+            # For system wide available cipher suites use: /usr/bin/openssl ciphers -v
+            # For formatting rules see: https://www.openssl.org/docs/man1.1.1/man3/SSL_CONF_cmd.html
+            "CipherString" => "ECDHE-RSA-AES128-SHA",                                   # TLSv1.2 and bellow
+            "CipherSuites" => "TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384",    # TLSv1.3+ (OpenSSl 1.1.1+)
+
+            "Options" => "PrioritizeChaCha",
+            "Protocol" => "-ALL,TLSv1.3",
+        )
+    )
+
+
peer-verify()