Cloudflare's Internet facing SSL configuration
Clone or download
vkrasnov Merge pull request #66 from Injust/master
Fix SPDY patch and update for nginx 1.13.0
Latest commit 796bc5a Jun 28, 2017
Permalink
Failed to load latest commit information.
patches Merge pull request #66 from Injust/master Jun 28, 2017
.gitignore Update README and .gitignore May 3, 2014
LICENSE Initial commit May 3, 2014
README.md Don't mention OpenSSL Jun 6, 2017
conf Update to latest SSL config Jun 6, 2017

README.md

sslconfig

Cloudflare's Internet facing SSL cipher configuration

This repository tracks the history of the SSL cipher configuration used for Cloudflare's public-facing SSL web servers. The repository tracks an internal Cloudflare repository, but dates may not exactly match when changes are made.

There is a single file called conf which contains the configuration used in Cloudflare's NGINX servers. This is only a fragment of the configuration.

ChaCha20/Poly1305 patch

Cloudflare uses a patch for OpenSSL that enables the ChaCha20/Poly1305 cipher suites and implements special logic to ensure it is only taken if it is the client's top cipher choice. Without this patch, the cipher suite choice in the configuration will not work correctly.