0

I'm a rookie in the cipher world, and I'm setting up squid as an TLS proxy. in an example it uses:

cipher=EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!SHA1:!MD5:!EXP:!PSK:!SRP:!DSS tls-dh=prime256v1:/usr/local/squid/etc/dhparam.pem

.. and for me, the configuration string looks like something already encrypted..

Does it need that long string, or is it outdated?

The only thing I personally recognize is Sha & md5

2
  • 1
    Why do you need to set it in the first place? If you use a recent systems the defaults should be fine. Also see the recommendations from Mozilla. While they show configs for nginx and apache the same recommendations can be done for squid. Aug 12 at 17:50
  • as I wrote, rookie.. but you should write this as an answer, because on that page you can see what's correct
    – JoBe
    Aug 12 at 18:14
3

If you have a recent system then it is likely a good option to net set these values at all, but just use the implicit defaults. If you don't have a recent system you should likely get one, since this is needed to support the modern TLS 1.3 protocol version.

There might be cases where one need to configure the ciphers anyway, like to support older clients. In this case please follow the recommendations from Mozilla. While these are primarily for web servers and provides the necessary syntax for nginx and apache, the same cipher syntax is actually used within squid and the recommendations for the web servers also apply for the web proxy.

2
  • You can use the Mozilla SSL Configuration Generator : ssl-config.mozilla.org. Squid is not in the available options but your should be able to port a configuration from another (especially the list of ciphers).
    – ysdx
    Aug 13 at 7:40
  • 1
    @ysdx: "You can use the Mozilla SSL Configuration Generator" - this is basically the same link I already have in my answer, only one click further and thus with less context. Aug 13 at 7:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.