ECC certificates and TLS policy 2018-06-21

[davidep (Davide Principi)]

A new TLS policy is available: 2018-06-21.

• The slapd service (local LDAP accounts provider) is now protected against POODLE if the new policy is enabled
• The Server Manager now sanitizes the uploaded certificates, by appending EOL if missing /thanks @Stll0
• It is now possible to upload a sci-fi ECC certificate with Server Manager
• The new policy allows to select an ECC certificate as system-wide default /thanks @stephdl

See also the manual:

http://docs.nethserver.org/en/latest/tlspolicy.html#policy-2018-06-21

This feature was discussed here /thanks @danb35

Default TLS policy doesn't allow connections with ECC certificate

Again, fresh install of 7.5beta on a test VM. After realizing that signal-event certificate-update didn’t restart httpd-admin, doing that restart manually gets it using the new cert, but it also implements the 20180330 TLS policy, which I’d already chosen in my 7.4 production server without a problem. However, on 7.5, I can’t connect when this policy is in effect. I’ve tried using Firefox Mac 59.0.2 and Safari 11.1. Firefox gives the error of “SSL_ERROR_NO_CYPHER_OVERLAP”, while Safari doesn…