From: Alexander Barton <alex@barton.de>
Date: Sun, 26 Oct 2014 10:55:28 +0000 (+0100)
Subject: INSTALL: List the changed SSL CipherList default value.
X-Git-Tag: rel-22.1~18^2
X-Git-Url: https://arthur.barton.de/cgi-bin/gitweb.cgi?p=ngircd-alex.git;a=commitdiff_plain;h=cdcf474f159ad0c3c2a652cdbfa5e7f09171667c;hp=100de3e4ccaab10524821d4262f6a8c3342224f8

INSTALL: List the changed SSL CipherList default value.
---

diff --git a/INSTALL b/INSTALL
index cf33fa34..0aa853c1 100644
--- a/INSTALL
+++ b/INSTALL
@@ -12,12 +12,21 @@
 I. Upgrade Information
 ~~~~~~~~~~~~~~~~~~~~~~
 
+Differences to version 22.x
+
+- The default value of the SSL "CipherList" variable has been changed to
+  "HIGH:!aNULL:@STRENGTH:!SSLv3" (OpenSSL) and "SECURE128:-VERS-SSL3.0"
+  (GnuTLS) to disable the old SSLv3 protocol by default.
+  To enable connections of clients still requiring the weak SSLv3 protocol,
+  the "CipherList" must be set to its old value (not recommended!), which
+  was "HIGH:!aNULL:@STRENGTH" (OpenSSL) and "SECURE128" (GnuTLS), see below.
+
 Differences to version 20.x
 
 - Starting with ngIRCd 21, the ciphers used by SSL are configurable and
-  default to HIGH:!aNULL:@STRENGTH (OpenSSL) or SECURE128 (GnuTLS).
-  Previous version were using the OpenSSL or GnuTLS defaults, DEFAULT
-  and NORMAL respectively.
+  default to "HIGH:!aNULL:@STRENGTH" (OpenSSL) or "SECURE128" (GnuTLS).
+  Previous version were using the OpenSSL or GnuTLS defaults, "DEFAULT"
+  and "NORMAL" respectively.
 
 - When adding GLINE's or KLINE's to ngIRCd 21 (or newer), all clients matching
   the new mask will be KILL'ed. This was not the case with earlier versions