Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-24897

Configure Diffie-Hellman parameters for OpenSSL

    XMLWordPrintableJSON

Details

    • Icon: Improvement Improvement
    • Resolution: Done
    • Icon: Major - P3 Major - P3
    • 3.5.12
    • None
    • Networking, Security
    • None
    • Fully Compatible
    • Platforms 2017-07-31, Platforms 2017-08-21

    Description

      In order to enable Perfect Forward Security compatible cipher suites when using OpenSSL, we should to configure OpenSSL via the guidelines here: https://wiki.openssl.org/index.php/Diffie-Hellman_parameters

      Though standard Diffie-Hellman seems fairly straightforward to configure, note that the preferred way to configure Elliptic Curve Diffie-Hellman requires a call to SSL_CTX_set_ecdh_auto, which as a symbol is only exposed by OpenSSL 1.0.2 and above. We may wish to switch between ECDH configuration implementations based on what's available at compile time, though the majority of vendor supplied OpenSSL libraries will not currently be able to use it. Runtime acquisition of a function pointer may also be possible, but would be more difficult to implement.

      Attachments

        Activity

          People

            adam.martin@mongodb.com ADAM Martin (Inactive)
            spencer.jackson@mongodb.com Spencer Jackson
            Votes:
            1 Vote for this issue
            Watchers:
            12 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: