Re: relayd: use the libtls secure keyword for the default ciphers

On Tue Jun 16, 2026 at 08:03:05AM +0200, Rafael Sadowski wrote:
> Based on an idea from Mischa, I would like to switch the default
> cipher from "HIGH:!aNULL" to "secure" aka.
> TLSv1.3:TLSv1.2+AEAD+ECDHE:TLSv1.2+AEAD+DHE", which selects the stricter
> modern set (AEAD ciphers with forward secrecy).
> 
> I have replaced the text in the manpage with the "cipher" text from
> smtpd.conf.5, which is easier to understand.
> 
> In my view it makes sense to mention it in faq/current.html, as some
> legacy systems might not work with it?
> 
> Rafael
> 

This is the same for httpd.

diff --git a/httpd.conf.5 b/httpd.conf.5
index c85f36d..7224a6a 100644
--- a/httpd.conf.5
+++ b/httpd.conf.5
@@ -693,14 +693,15 @@ The
 should contain a PEM encoded certificate.
 The default is
 .Pa /etc/ssl/server.crt .
-.It Ic ciphers Ar string
-Specify the TLS cipher string.
+.It Cm ciphers Ar cipherstr
+Define the list of ciphers that may be used for TLS sessions.
+Refer to the
+.Xr tls_config_set_ciphers 3
+manpage for the format of
+.Ar cipherstr .
 If not specified, the default value
-.Qq HIGH:!aNULL
-will be used (strong crypto cipher suites without anonymous DH).
-See the CIPHERS section of
-.Xr openssl 1
-for information about TLS cipher suites and preference lists.
+.Ql secure
+will be used.
 .It Ic client ca Ar cafile Oo Ic crl Ar crlfile Oc Op Ic optional
 Require
 .Po
diff --git a/httpd.h b/httpd.h
index 12122c6..c0385ed 100644
--- a/httpd.h
+++ b/httpd.h
@@ -62,7 +62,7 @@
 #define HTTPD_TLS_CERT		"/etc/ssl/server.crt"
 #define HTTPD_TLS_KEY		"/etc/ssl/private/server.key"
 #define HTTPD_TLS_CONFIG_MAX	511
-#define HTTPD_TLS_CIPHERS	"compat"
+#define HTTPD_TLS_CIPHERS	"secure"
 #define HTTPD_TLS_DHE_PARAMS	"none"
 #define HTTPD_TLS_ECDHE_CURVES	"default"
 #define HTTPD_FCGI_NAME_MAX	511