ustream-ssl: Enable ECDHE with OpenSSL.
authorRosen Penev <rosenp@gmail.com>
Sun, 1 Apr 2018 01:37:28 +0000 (18:37 -0700)
committerJohn Crispin <john@phrozen.org>
Mon, 30 Apr 2018 13:05:09 +0000 (15:05 +0200)
When used with LuCI, SSLlabs complains that Forward Secrecy is not enabled and thus caps the score to a B.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
ustream-openssl.c

index 83f61406136f460a1444b3847c90b0f8d3656a4d..2faa8557fbb32384aceb3b8346b404eebf2cba56 100644 (file)
@@ -49,6 +49,9 @@ __ustream_ssl_context_new(bool server)
                return NULL;
 
        SSL_CTX_set_verify(c, SSL_VERIFY_NONE, NULL);
+#ifndef OPENSSL_NO_ECDH
+       SSL_CTX_set_ecdh_auto(c, 1);
+#endif
        SSL_CTX_set_quiet_shutdown(c, 1);
 
        return (void *) c;