From: Björn Jacke Date: Thu, 13 Feb 2020 13:43:44 +0000 (+0100) Subject: DOC: improve description of no-tls-tickets X-Git-Tag: v2.2-dev4~3 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7b5e1364587beae59a39da5a86ec095fa8bedef8;p=thirdparty%2Fhaproxy.git DOC: improve description of no-tls-tickets It was not obvious, that this setting only affects TLS versions <= 1.2 and it we should also mention the security implication of session tickets here. Signed-off-by: Bjoern Jacke --- diff --git a/doc/configuration.txt b/doc/configuration.txt index ab501ead6b..34d5076f65 100644 --- a/doc/configuration.txt +++ b/doc/configuration.txt @@ -11677,6 +11677,10 @@ no-tls-tickets extension) and force to use stateful session resumption. Stateless session resumption is more expensive in CPU usage. This option is also available on global statement "ssl-default-bind-options". + The TLS ticket mechanism is only used up to TLS 1.2 and it is prone to + man-in-the-middle attacks. You should consider to disable them for + security reasons. TLS 1.3 implements more secure methods for session + resumption. no-tlsv10 This setting is only available when support for OpenSSL was built in. It @@ -12376,6 +12380,10 @@ no-tls-tickets extension) and force to use stateful session resumption. Stateless session resumption is more expensive in CPU usage for servers. This option is also available on global statement "ssl-default-server-options". + The TLS ticket mechanism is only used up to TLS 1.2 and it is prone to + man-in-the-middle attacks. You should consider to disable them for + security reasons. TLS 1.3 implements more secure methods for session + resumption. See also "tls-tickets". no-tlsv10