3 ms·
You can turn off TLS on Kore. $ make BENCHMARK=1 It is not a run time option by design, but it is there. I want Kore to have sane defaults for getting up and
by jvink 11y ago
You can turn off TLS on Kore.
$ make BENCHMARK=1
It is not a run time option by design, but it is there.
I want Kore to have sane defaults for getting up and running. That means TLS (1.2 default by only), no RSA based key exchanges, AEAD ciphers preferred and the likes.
edit: spelling
- crest 11y agoRSA with DHE or ECDHE is a sane handshake. I would avoid DSA and ECDSA based key exchanges because they fail catastrophically with bad random number generators. For most APIs session caching is more important than a faster initial handshake. The HTTPS only choice would annoy me a lot because I run most HTTPS services in behind a reverse proxy in a FreeBSD jail on the same host. HA proxy and nginx are still superior to most applications in regard to reliable TLS termination. Using HTTPS by default a the right choice for a new project but offering no HTTP support (outside of a benchmark) patronizes the user. All in all this looks like a nice way to export C APIs through HTTPS.