Re: Get at SSL context

It is great that you post what you found at the end.
I did a lot of search and none of them show how to change the ssl context 
setting after loading the config.
Really helpful.
Thanks a lot.

On Wednesday, September 21, 2016 at 10:44:22 PM UTC+8, Gertjan Klein wrote:
>
> An update: I managed to change the ssl context settings. Between that 
> and a few security headers, I now get an A+ at the SSLlabs server test. 
> :-) 
>
> For those interested, here is how I did it: 
>
> Exported from Notepad++ Exported from Notepad++ Exported from Notepad++ 
> Exported from Notepad++ def create_server(): 
>      # Remove default server, we need two separate ones 
>      cherrypy.server.unsubscribe() 
>
>      # Create server for HTTP 
>      svr = cherrypy._cpserver.Server() 
>      svr._socket_host = "0.0.0.0" 
>      svr.socket_port = 80 
>      svr.subscribe() 
>
>      # Create server for HTTPS 
>      svr = cherrypy._cpserver.Server() 
>      svr._socket_host = '0.0.0.0' 
>      svr.socket_port = 443 
>      svr.ssl_module = 'builtin' 
>      svr.ssl_certificate = CERT_INFO['ssl_certificate'] 
>      svr.ssl_private_key = CERT_INFO['ssl_private_key'] 
>      svr.ssl_certificate_chain = CERT_INFO['ssl_certificate_chain'] 
>      svr.subscribe() 
>
>      # Mount root server and update global config 
>      cherrypy.tree.mount(Root(), '', CONF) 
>      cherrypy.config.update(CONF) 
>
>      # Start the server 
>      cherrypy.engine.start() 
>
>      # Get the ssl module's default context 
>      ssl_context = svr.httpserver.ssl_adapter.context 
>      # Turn off TLS v1.0 and v1.1 
>      ssl_context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1 
>      # Limit ciphers to most secure ones 
> ssl_context.set_ciphers('AES256+EECDH:AES256+EDH:!aNULL') 
>
>      cherrypy.engine.block() 
>
> Regards, 
> Gertjan. 
>
>

-- 
You received this message because you are subscribed to the Google Groups "cherrypy-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cherrypy-users+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/[email protected]
To post to this group, send email to cherrypy-users-/JYPxA39Uh5TLH3MbocFF+G/[email protected]
Visit this group at https://groups.google.com/group/cherrypy-users.
For more options, visit https://groups.google.com/d/optout.