Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (athena.apache.org: message received from 54.191.145.13
 which is an MX secondary for dev@httpd.apache.org)
Message-ID: <55493695.7090507@gmx.de>
Date: Tue, 05 May 2015 23:31:01 +0200
From: olli hauer <ohauer@gmx.de>
User-Agent: Mozilla/5.0 (Windows NT 5.1;
 rv:31.0) Gecko/20100101 Thunderbird/31.6.0
MIME-Version: 1.0
To: dev@httpd.apache.org
Subject: Re: Looking ahead to 2.4.13 / 2.2.30
References: 
 <CACsi250CPCr5khrVdk6+yp_oJzc=7H2nXatOV3jnxSKz_4jRwQ@mail.gmail.com>
 <CAKQ1sVO1oQC9TT5vXcYDOtNQfqsjGF2HkZs2eVXeOia70GsTvA@mail.gmail.com>
In-Reply-To: 
 <CAKQ1sVO1oQC9TT5vXcYDOtNQfqsjGF2HkZs2eVXeOia70GsTvA@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit

On 2015-05-05 15:03, Yann Ylavic wrote:
> On Thu, Apr 30, 2015 at 11:52 PM, William A Rowe Jr <wrowe@rowe-clan.net> wrote:
>>
>> Concerns / observations / thoughts?
> 
> I'd like to propose those 2.4.x CHANGES (r1542327+r1569005+r1542327)
> for backport to 2.2.x (in reverse order):
> 
>   *) mod_ssl: Fix tmp DH parameter leak, adjust selection to prefer
>      larger keys and support up to 8192-bit keys.  [Ruediger Pluem,
>      Joe Orton]
> 
>   *) mod_ssl: Improve handling of ephemeral DH and ECDH keys by
>      allowing custom parameters to be configured via SSLCertificateFile,
>      and by adding standardized DH parameters for 1024/2048/3072/4096 bits.
>      Unless custom parameters are configured, the standardized parameters
>      are applied based on the certificate's RSA/DSA key size. [Kaspar Brand]
> 
>   *) mod_ssl, configure: Require OpenSSL 0.9.8a or later. [Kaspar Brand]
> 
>   *) mod_ssl: drop support for export-grade ciphers with ephemeral RSA
>      keys, and unconditionally disable aNULL, eNULL and EXP ciphers
>      (not overridable via SSLCipherSuite). [Kaspar Brand]
> 
> or at least partly.
> 

Perhaps it is also a good time do kick SSLv2 support from 2.2.x ;)