30-tls.yml 670 B

12345678910111213141516171819
  1. # only allow tls1.2 and tls1.3
  2. define_macro:
  3. 'TLS_CIPHERS': "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"
  4. 'TLS_OPTIONS':
  5. - "no_sslv3"
  6. - "no_tlsv1"
  7. - "no_tlsv1_1"
  8. - "cipher_server_preference"
  9. - "no_compression"
  10. c2s_ciphers: 'TLS_CIPHERS'
  11. s2s_ciphers: 'TLS_CIPHERS'
  12. c2s_protocol_options: 'TLS_OPTIONS'
  13. s2s_protocol_options: 'TLS_OPTIONS'
  14. certfiles:
  15. - /etc/ssl/ejabberd/fullchain.pem
  16. - /etc/ssl/ejabberd/key.pem