From 015c79627b51d4b8d1e950a1ef525761b2a4eb4d Mon Sep 17 00:00:00 2001 From: Zach Wasserman Date: Mon, 25 Jan 2021 13:08:41 -0800 Subject: [PATCH] Add ciphersuites for compability with Go HTTP/2 (#226) Fixes a misconfiguration due to #212 that prevented the server from starting up in `modern` tls compatibility mode. --- cmd/fleet/serve.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/cmd/fleet/serve.go b/cmd/fleet/serve.go index 9d58c9b5d8..a19af855d6 100644 --- a/cmd/fleet/serve.go +++ b/cmd/fleet/serve.go @@ -387,6 +387,11 @@ func getTLSConfig(profile string) *tls.Config { tls.TLS_AES_128_GCM_SHA256, tls.TLS_AES_256_GCM_SHA384, tls.TLS_CHACHA20_POLY1305_SHA256, + // These cipher suites not explicitly listed by Mozilla, but + // required by Go's HTTP/2 implementation + // See: https://go-review.googlesource.com/c/net/+/200317/ + tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, + tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, ) case config.TLSProfileIntermediate: cfg.MinVersion = tls.VersionTLS12