diff options
| author | gabasync <32149439+gabasync@users.noreply.github.com> | 2017-09-21 22:29:50 +0300 |
|---|---|---|
| committer | Daniel Hansson <daniel@techandme.se> | 2017-09-21 22:29:50 +0300 |
| commit | 5076852d068e2eded2c24f94c2944a587745ffa4 (patch) | |
| tree | c4bb42aca9aa8cf494080c1f86eda520c206e4bc /lets-encrypt | |
| parent | 0ae1be87317e8868b005f8c87eaece3d9ee5e2f1 (diff) | |
DHPARAMS 4096 to allow for IE11/Win7 to work instead of Page Cant Be Displayed (#369)
ssllabs.com shows a standard IE11/Win7 setup will not work. For companies that do not allow alternative popular Browsers this can be a non go for internal company deployment. Lowering the DH to 4096 may alleviate this issue. Below is the ssllabs.com lab results:
IE 11 / Win 7 R Client does not support DH parameters > 4096 bits
RSA 4096 (SHA256) | TLS 1.2 | TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 | DH 8192
Diffstat (limited to 'lets-encrypt')
| -rw-r--r-- | lets-encrypt/activate-ssl.sh | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lets-encrypt/activate-ssl.sh b/lets-encrypt/activate-ssl.sh index ab1dd27e..e48bf70c 100644 --- a/lets-encrypt/activate-ssl.sh +++ b/lets-encrypt/activate-ssl.sh @@ -248,7 +248,7 @@ if [ -d "$CERTFILES" ] # Generate DHparams chifer if [ ! -f "$DHPARAMS" ] then - openssl dhparam -dsaparam -out "$DHPARAMS" 8192 + openssl dhparam -dsaparam -out "$DHPARAMS" 4096 fi # Activate new config check_command bash "$SCRIPTS/test-new-config.sh" "$domain.conf" |