How to disable SSL/TLS Client-Initiated Renegotiation

[N0tronic]

Hey guys,

I found a vulnerability in my TLS check against the broker (Client-Initiated Renegotiation).
In the config file is an option to enable secure renegotiation but nothing for client-initiated-renegotiation.

Is that a known issue, or I only not found this option?

thx and greetings

[zmstone]

this is configurable in the ssl library, but we have not made it an option for EMQ X users.
https://erlang.org/doc/man/ssl.html#type-client_renegotiation

we'll look into it.

[zmstone]

fixing it here: #5754