Skip to content

Commit

Permalink
Don't set default ciphers for OpenSSL client sockets
Browse files Browse the repository at this point in the history
It should be up to the OS to set the default ciphers, eg. if a cipher
suddenly is deemed insecure or there's a reason to have another cipher
order, such as ChaCha over any AES cipher because of lack of hardware
support.

Currently Crystal will expose up-to-date OS to security considirations
because of hard coded cipher lists, that might not be so up to date,
unless the application is recompiled with a modern Crystal version.
  • Loading branch information
carlhoerberg committed Jul 22, 2023
1 parent 609e129 commit 469b348
Showing 1 changed file with 0 additions and 2 deletions.
2 changes: 0 additions & 2 deletions src/openssl/ssl/context.cr
Original file line number Diff line number Diff line change
Expand Up @@ -49,8 +49,6 @@ abstract class OpenSSL::SSL::Context
{% if LibSSL.has_method?(:x509_verify_param_lookup) %}
self.default_verify_param = "ssl_server"
{% end %}

self.ciphers = CIPHERS_OLD
end

# Returns a new TLS client context with only the given method set.
Expand Down

0 comments on commit 469b348

Please sign in to comment.