ssl: gnutls: bump dh bitsize to 2048

problem is that some clients refuse to connect to severs that only offer
1024.  For interoperability it would be best to just use 4096, but that
takes minutes, even on current hardware.

diff --git a/doc/SSL.txt b/doc/SSL.txt
index 394894a2a103e8d6ccaa74258d40c35b3890e518..b98c2fbeef7c2fa5273643f84f13d3fc7c73f4d7 100644 (file)
--- a/doc/SSL.txt
+++ b/doc/SSL.txt
@@ -51,7 +51,7 @@ OpenSSL:
 Creating a self-signed certificate and key:
  $ openssl req -newkey rsa:2048 -x509 -keyout server-key.pem -out server-cert.pem -days 1461
 Create DH parameters (optional):
 Creating a self-signed certificate and key:
  $ openssl req -newkey rsa:2048 -x509 -keyout server-key.pem -out server-cert.pem -days 1461
 Create DH parameters (optional):

- $ openssl dhparam -2 -out dhparams.pem 2048
+ $ openssl dhparam -2 -out dhparams.pem 4096

 
 GnuTLS:
 
 
 GnuTLS:
 


@@ -59,7 +59,7 @@ Creating a self-signed certificate and key:
  $ certtool --generate-privkey --bits 2048 --outfile server-key.pem
  $ certtool --generate-self-signed --load-privkey server-key.pem --outfile server-cert.pem
 Create DH parameters (optional):
  $ certtool --generate-privkey --bits 2048 --outfile server-key.pem
  $ certtool --generate-self-signed --load-privkey server-key.pem --outfile server-cert.pem
 Create DH parameters (optional):

- $ certtool  --generate-dh-params --bits 2048 --outfile dhparams.pem
+ $ certtool  --generate-dh-params --bits 4096 --outfile dhparams.pem

 
 
 Alternate approach using stunnel(1)
 
 
 Alternate approach using stunnel(1)

diff --git a/src/ngircd/conn-ssl.c b/src/ngircd/conn-ssl.c
index edcc5bd567a3af074a2cf0af2f5ff6fab5978bcf..7630420dad36bfa46e2dbb0590e382055f3d7979 100644 (file)
--- a/src/ngircd/conn-ssl.c
+++ b/src/ngircd/conn-ssl.c
@@ -51,7 +51,7 @@ static bool ConnSSL_LoadServerKey_openssl PARAMS(( SSL_CTX *c ));
 #include <unistd.h>
 #include <gnutls/x509.h>
 
 #include <unistd.h>
 #include <gnutls/x509.h>
 

-#define DH_BITS 1024
+#define DH_BITS 2048

 static gnutls_certificate_credentials_t x509_cred;
 static gnutls_dh_params_t dh_params;
 
 static gnutls_certificate_credentials_t x509_cred;
 static gnutls_dh_params_t dh_params;