From 1e9c6d7931644b6becf05de800d9e74d59df3d2c Mon Sep 17 00:00:00 2001 From: Sadie Powell Date: Tue, 9 Jan 2024 21:04:33 +0000 Subject: Always disable SSLv3 support, allow disabling TLSv1.[012]. --- data/modules.example.conf | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) (limited to 'data') diff --git a/data/modules.example.conf b/data/modules.example.conf index f1706e7b3..fb4f6a6d9 100644 --- a/data/modules.example.conf +++ b/data/modules.example.conf @@ -630,12 +630,13 @@ module { name = "m_sasl" } key = "data/privkey.pem" /* - * As of 2014 SSL 3.0 is considered insecure, but it might be enabled - * on some systems by default for compatibility reasons. - * You can use the following option to enable or disable it explicitly. - * Leaving this option not set defaults to the default system behavior. + * If you wish to increase security you can disable support for older + * versions of TLS with no known vulnerabilities but that provide less + * security. For your security SSLv2 and SSLv3 are always disabled. */ - #sslv3 = no + #tlsv10 = no + #tlsv11 = no + #tlsv12 = yes } /* -- cgit