Re: ZEO SSL support and Daft docs

On Wed, 22 Jun 2016 17:38:03 -0700,
Patrick Strawderman <[email protected]> wrote :
> I was going to advocate only supporting TLS 1.2 as well, but didn't have
> time to think about the implications. I believe it means OpenSSL >= 1.0.1
> would be a requirement (which was released 4 years ago). Note that it seems
> like OS X (10.11.5) still ships with OpenSSL 0.9.8 :-(. Anyway, TLS 1.2 is
> definitely attractive, because of ECC, perfect forward secrecy, etc.

Ah yes, I did not think about the implications on dependencies.
I would tend to think these would be second to security as "the future
will be here soon" (ie, don't hesitate to depend on newer stuff, as it
will be widespread before you know it), but your OSX example shows even
the distant past is not quite there yet...

Something else, about SSL testing: I like to use openssl's s_client
command to debug SSL issues (tell which certificate is served, check if
intermediate certificates are served properly, check which cipher suite
gets chosen...). That command either works on pure ssl sockets (ie, SSL
protocol runs before application protocol), or with starttls (the other
way around). In the later requires s_client to know the expected
command to start the SSL handshake.
If SSL support in ZEO uses starttls-style negociation, it would be
handy if it happened to match existing starttls protocols... Not
required, but handy.

BTW: I use "SSL" above as a generic term for SSL and TLS, TLS just
meaning "SSL strictly above v3.0" to me.

Regards,
-- 
Vincent Pelletier
ERP5 - open source ERP/CRM for flexible enterprises

-- 
You received this message because you are subscribed to the Google Groups "zodb" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
For more options, visit https://groups.google.com/d/optout.