Skip to content

Commit 0b511fb

Browse files
Correct TLS settings not compatible with TLSv1.3
(cherry picked from commit d52f8da)
1 parent 50790a1 commit 0b511fb

File tree

1 file changed

+8
-3
lines changed

1 file changed

+8
-3
lines changed

deps/rabbit/docs/rabbitmq.conf.example

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -93,11 +93,14 @@
9393
# ssl_options.certfile = /path/to/cert.pem
9494
# ssl_options.keyfile = /path/to/key.pem
9595
#
96-
## These are highly recommended for TLSv1.2 but cannot be used
97-
## with TLSv1.3. If TLSv1.3 is enabled, these lines MUST be removed.
9896
# ssl_options.honor_cipher_order = true
9997
# ssl_options.honor_ecc_order = true
10098
#
99+
## These are highly recommended for TLSv1.2 but cannot be used
100+
## with TLSv1.3. If TLSv1.3 is enabled, these lines MUST be removed.
101+
# ssl_options.client_renegotiation = false
102+
# ssl_options.secure_renegotiate = true
103+
#
101104
## Limits what TLS versions the server enables for client TLS
102105
## connections. See https://www.rabbitmq.com/ssl.html#tls-versions for details.
103106
##
@@ -629,12 +632,14 @@
629632
## More TLS options
630633
# management.ssl.honor_cipher_order = true
631634
# management.ssl.honor_ecc_order = true
635+
636+
## These are highly recommended for TLSv1.2 but cannot be used
637+
## with TLSv1.3. If TLSv1.3 is enabled, these lines MUST be removed.
632638
# management.ssl.client_renegotiation = false
633639
# management.ssl.secure_renegotiate = true
634640

635641
## Supported TLS versions
636642
# management.ssl.versions.1 = tlsv1.2
637-
# management.ssl.versions.2 = tlsv1.1
638643

639644
## Cipher suites the server is allowed to use
640645
# management.ssl.ciphers.1 = ECDHE-ECDSA-AES256-GCM-SHA384

0 commit comments

Comments
 (0)