##
# BEGIN COPYRIGHT BLOCK
# Copyright (C) 2015 Red Hat, Inc.
# All rights reserved.
# END COPYRIGHT BLOCK
#
# This file contains the default sslRangeCiphers that come with this version of
# the PKI software in its <instance>/conf/server.xml file.
#
# Depending on which kind of SSL server you have, you want to reference the
# corresponding cipher suite for making adjustments to your instance
# server.xml.
#
#
#        About the TLS range related parameters:
#
#              'sslVersionRangeStream'
#              'sslVersionRangeDatagram'
#              'sslRangeCiphers'
#
#        The default sslVersionRangeStream and sslVersionRangeDatagram
#        parameters contain values that are supported by the native NSS.
#        Changes can be made to restrict or relax the support.
#
#        The default sslRangeCiphers parameter contains a list of ciphers best
#        suited for the type of the server installed.  Changes can be made to
#        suit each site's needs.
#
#        The TLS_ECDHE_RSA_* ciphers provide Perfect Forward Secrecy,
#        which, while provide added security to the already secure and adequate
#        TLS_RSA_* ciphers, requires 3 times longer to establish SSL sessions.
#        In our testing environment, some HSM might also have issues providing
#        subsystem->subsystem SSL handshake.  We are therefore turning them
#        off by default.  One can enable them manually by turning the "-" to
#        "+" under sslRangeCiphers and restart the subsystem.
#
#            TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
#            TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
#            TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
#            TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
#            TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
#
#        The following ciphers are supported in RHEL 7.2 or greater, and
#        are turned on by default. They can be turned off by sites running
#        older versions of RHEL:
#
#            TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,
#            TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
#            TLS_DHE_RSA_WITH_AES_256_CBC_SHA,
#            TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
#            TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,
#            TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
#
#        For RHEL 7.5 or greater:
#
#            * all '3DES' ciphers have been disabled,
#            * the default sslVersionRangeStream and
#              sslVersionRangeDatagram ranges have been upgraded to
#              only allow ciphers in the TLS1.1 to TLS1.2 range, and
#            * the default sslRangeCiphers values have been altered to
#              include all recommended 'FIPS' ciphers for both RSA and ECC
#              servers regardless of whether 'FIPS' is enabled or disabled
#
#            Default ciphers enabled for RSA servers:
#
#                +TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
#                +TLS_DHE_RSA_WITH_AES_256_CBC_SHA,
#                +TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
#                +TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,
#                +TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
#                +TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,
#                +TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
#                +TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
#                +TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
#                +TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
#                +TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
#                +TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
#
#            Default ciphers enabled for ECC servers:
#
#                +TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
#                +TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
#                +TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
#                +TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
#                +TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
#                +TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
#
#        For RHEL 7.6 or greater:
#
#        The following ciphers do not work with HSM in FIPS mode, and
#        are therefore disabled by default.
#
#            TLS_RSA_WITH_AES_256_CBC_SHA,
#            TLS_RSA_WITH_AES_128_CBC_SHA,
#            TLS_RSA_WITH_AES_128_CBC_SHA256,
#            TLS_RSA_WITH_AES_256_CBC_SHA256,
#            TLS_RSA_WITH_AES_128_GCM_SHA256,
#            TLS_RSA_WITH_AES_256_GCM_SHA384
#
#            note:
#              * They are currently not preferred in TLS 1.2
#              * They are deprecated in TLS 1.3
#
##
# For RSA servers:
           sslRangeCiphers="-TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,-TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,-TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,+TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,-TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,-TLS_DHE_DSS_WITH_AES_128_CBC_SHA,-TLS_DHE_DSS_WITH_AES_256_CBC_SHA,-TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_DHE_RSA_WITH_AES_128_CBC_SHA,+TLS_DHE_RSA_WITH_AES_256_CBC_SHA,+TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,+TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,+TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,-TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,-TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,+TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,-TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,+TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,-TLS_RSA_WITH_AES_128_CBC_SHA256,-TLS_RSA_WITH_AES_256_CBC_SHA256,-TLS_RSA_WITH_AES_128_GCM_SHA256,-TLS_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_RSA_WITH_AES_128_CBC_SHA,-TLS_RSA_WITH_AES_256_CBC_SHA,+TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,+TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,+TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,-TLS_RSA_WITH_AES_256_GCM_SHA384"
#
#
# For ECC servers:
           sslRangeCiphers="-TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,-TLS_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_RSA_WITH_AES_128_CBC_SHA,-TLS_RSA_WITH_AES_256_CBC_SHA,-TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,-TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,-TLS_DHE_DSS_WITH_AES_128_CBC_SHA,-TLS_DHE_DSS_WITH_AES_256_CBC_SHA,-TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,-TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_DHE_RSA_WITH_AES_128_CBC_SHA,-TLS_DHE_RSA_WITH_AES_256_CBC_SHA,-TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,-TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,-TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,-TLS_RSA_WITH_AES_128_CBC_SHA256,-TLS_RSA_WITH_AES_256_CBC_SHA256,-TLS_RSA_WITH_AES_128_GCM_SHA256,+TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,+TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,-TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,-TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,+TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
