Re: Get at SSL context

An update: I managed to change the ssl context settings. Between that 
and a few security headers, I now get an A+ at the SSLlabs server test. :-)

For those interested, here is how I did it:

Exported from Notepad++ Exported from Notepad++ Exported from Notepad++ 
Exported from Notepad++ def create_server():
     # Remove default server, we need two separate ones
     cherrypy.server.unsubscribe()

     # Create server for HTTP
     svr = cherrypy._cpserver.Server()
     svr._socket_host = "0.0.0.0"
     svr.socket_port = 80
     svr.subscribe()

     # Create server for HTTPS
     svr = cherrypy._cpserver.Server()
     svr._socket_host = '0.0.0.0'
     svr.socket_port = 443
     svr.ssl_module = 'builtin'
     svr.ssl_certificate = CERT_INFO['ssl_certificate']
     svr.ssl_private_key = CERT_INFO['ssl_private_key']
     svr.ssl_certificate_chain = CERT_INFO['ssl_certificate_chain']
     svr.subscribe()

     # Mount root server and update global config
     cherrypy.tree.mount(Root(), '', CONF)
     cherrypy.config.update(CONF)

     # Start the server
     cherrypy.engine.start()

     # Get the ssl module's default context
     ssl_context = svr.httpserver.ssl_adapter.context
     # Turn off TLS v1.0 and v1.1
     ssl_context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
     # Limit ciphers to most secure ones
ssl_context.set_ciphers('AES256+EECDH:AES256+EDH:!aNULL')

     cherrypy.engine.block()

Regards,
Gertjan.

-- 
You received this message because you are subscribed to the Google Groups "cherrypy-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cherrypy-users+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/[email protected]
To post to this group, send email to cherrypy-users-/JYPxA39Uh5TLH3MbocFF+G/[email protected]
Visit this group at https://groups.google.com/group/cherrypy-users.
For more options, visit https://groups.google.com/d/optout.