0

I'm a rookie in the cipher world, and I'm setting up squid as an TLS proxy. in an example it uses:

cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!SHA1:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/usr/local/squid/etc/dhparam.pem

.. and for me, the configuration string looks like something already encrypted..

Does it need that long string, or is it outdated?

The only thing I personally recognize is Sha & md5

Improve this question
2
  • 1
    Why do you need to set it in the first place? If you use a recent systems the defaults should be fine. Also see the recommendations from Mozilla. While they show configs for nginx and apache the same recommendations can be done for squid.
    – Steffen Ullrich
    Aug 12, 2021 at 17:50
  • as I wrote, rookie.. but you should write this as an answer, because on that page you can see what's correct
    – JoBe
    Aug 12, 2021 at 18:14

1 Answer 1

Reset to default
3

If you have a recent system then it is likely a good option to net set these values at all, but just use the implicit defaults. If you don't have a recent system you should likely get one, since this is needed to support the modern TLS 1.3 protocol version.

There might be cases where one need to configure the ciphers anyway, like to support older clients. In this case please follow the recommendations from Mozilla. While these are primarily for web servers and provides the necessary syntax for nginx and apache, the same cipher syntax is actually used within squid and the recommendations for the web servers also apply for the web proxy.

Improve this answer
2
  • You can use the Mozilla SSL Configuration Generator : ssl-config.mozilla.org. Squid is not in the available options but your should be able to port a configuration from another (especially the list of ciphers).
    – ysdx
    Aug 13, 2021 at 7:40
  • 1
    @ysdx: "You can use the Mozilla SSL Configuration Generator" - this is basically the same link I already have in my answer, only one click further and thus with less context.
    – Steffen Ullrich
    Aug 13, 2021 at 7:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .