mirror of
https://github.com/openshift/openshift-docs.git
synced 2026-02-05 12:46:18 +01:00
49 lines
1.9 KiB
Plaintext
49 lines
1.9 KiB
Plaintext
// Module included in the following assemblies:
|
||
//
|
||
// * service_mesh/v1x/ossm-security.adoc
|
||
// * service_mesh/v2x/ossm-security.adoc
|
||
|
||
[id="ossm-security-cipher_{context}"]
|
||
= Configuring cipher suites and ECDH curves
|
||
|
||
Cipher suites and Elliptic-curve Diffie–Hellman (ECDH curves) can help you secure your service mesh. You can define a comma separated list of cipher suites using `spec.istio.global.tls.cipherSuites` and ECDH curves using `spec.istio.global.tls.ecdhCurves` in your `ServiceMeshControlPlane` resource. If either of these attributes are empty, then the default values are used.
|
||
|
||
The `cipherSuites` setting is effective if your service mesh uses TLS 1.2 or earlier. It has no effect when negotiating with TLS 1.3.
|
||
|
||
Set your cipher suites in the comma separated list in order of priority. For example, `ecdhCurves: CurveP256, CurveP384` sets `CurveP256` as a higher priority than `CurveP384`.
|
||
|
||
[NOTE]
|
||
====
|
||
You must include either `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256` or `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256` when you configure the cipher suite. HTTP/2 support requires at least one of these cipher suites.
|
||
|
||
====
|
||
|
||
The supported cipher suites are:
|
||
|
||
* TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||
* TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
|
||
* TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||
* TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
|
||
* TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||
* TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
|
||
* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|
||
* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||
* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
|
||
* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
|
||
* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||
* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
|
||
* TLS_RSA_WITH_AES_128_GCM_SHA256
|
||
* TLS_RSA_WITH_AES_256_GCM_SHA384
|
||
* TLS_RSA_WITH_AES_128_CBC_SHA256
|
||
* TLS_RSA_WITH_AES_128_CBC_SHA
|
||
* TLS_RSA_WITH_AES_256_CBC_SHA
|
||
* TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
|
||
* TLS_RSA_WITH_3DES_EDE_CBC_SHA
|
||
|
||
The supported ECDH Curves are:
|
||
|
||
* CurveP256
|
||
* CurveP384
|
||
* CurveP521
|
||
* X25519
|