CVS: cvs.openbsd.org: src

CVSROOT:	/cvs
Module name:	src
Changes by:	[email protected]	2026/06/27 23:08:28

Modified files:
	usr.sbin/httpd : httpd.conf.5 httpd.h 

Log message:
Switch the default TLS cipher set from "compat" to "secure"

The "secure" keyword only allows TLSv1.3 and the TLSv1.2 AEAD ciphers
that have forward secrecy (ECDHE/DHE).  See tls_config_set_ciphers(3)
for details.  This is stricter than "HIGH:!aNULL" and drops older
ciphers without AEAD or forward secrecy.

Also update the ciphers text in httpd.conf.5 with the clearer wording
from smtpd.conf.5.

Old peers that need these older ciphers may no longer connect.

idea from Mischa, ok kirill@ ok tb@