AWS cloudhsm high security documentation change
Summary
Updated TLS configuration guidance: 1) Clarified DH parameter requirements for DHE ciphers, 2) Modified cipher suites to remove non-PFS ciphers and add TLS 1.3 ciphers, 3) Uncommented ssl_dhparam directive, 4) Restructured HAProxy steps to include DH parameter generation in configuration comments
Security assessment
Changes enforce Perfect Forward Secrecy (PFS) by removing non-PFS ciphers (AES128-GCM-SHA256/AES256-GCM-SHA384) and adding TLS 1.3 ciphers. Uncommenting ssl_dhparam and emphasizing unique DH parameters mitigates Logjam attacks. Cipher updates address weak cryptographic standards.
Diff
diff --git a/cloudhsm/latest/userguide/third-offload-linux-openssl-provider.md b/cloudhsm/latest/userguide/third-offload-linux-openssl-provider.md index 0c6c566cf..b92e9dd7e 100644 --- a//cloudhsm/latest/userguide/third-offload-linux-openssl-provider.md +++ b//cloudhsm/latest/userguide/third-offload-linux-openssl-provider.md @@ -532 +532 @@ Then add the following to the TLS section of the file: - # It is *strongly* recommended to generate unique DH parameters + # It is *strongly* recommended to generate unique DH parameters for DHE ciphers @@ -538 +538 @@ Then add the following to the TLS section of the file: - ssl_ciphers "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305"; + ssl_ciphers "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256"; @@ -576 +576 @@ Then add the following to the TLS section of the file: - # It is *strongly* recommended to generate unique DH parameters + # It is *strongly* recommended to generate unique DH parameters for DHE ciphers @@ -582 +582 @@ Then add the following to the TLS section of the file: - ssl_ciphers "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305"; + ssl_ciphers "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256"; @@ -620 +620 @@ Then add the following to the TLS section of the file: - # It is *strongly* recommended to generate unique DH parameters + # It is *strongly* recommended to generate unique DH parameters for DHE ciphers @@ -626 +626 @@ Then add the following to the TLS section of the file: - ssl_ciphers "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305"; + ssl_ciphers "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256"; @@ -664 +664 @@ Then add the following to the TLS section of the file: - # It is *strongly* recommended to generate unique DH parameters + # It is *strongly* recommended to generate unique DH parameters for DHE ciphers for DHE ciphers @@ -666 +666 @@ Then add the following to the TLS section of the file: - #ssl_dhparam "/etc/ssl/certs/dhparams.pem"; + ssl_dhparam "/etc/ssl/certs/dhparams.pem"; @@ -670 +670 @@ Then add the following to the TLS section of the file: - ssl_ciphers "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305"; + ssl_ciphers "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256"; @@ -884,5 +884 @@ Use this section to configure HAProxy with the OpenSSL Provider. The following e - 4. Generate Diffie-Hellman parameters: - - $ openssl dhparam -out /etc/haproxy/dhparams.pem 2048 - - 5. Create a new CloudHSM TLS offload configuration at `/etc/haproxy/haproxy.cfg`: + 4. Create a new CloudHSM TLS offload configuration at `/etc/haproxy/haproxy.cfg`: @@ -893,3 +889,5 @@ Use this section to configure HAProxy with the OpenSSL Provider. The following e - ssl-dh-param-file /etc/haproxy/dhparams.pem - ssl-default-bind-ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305 - ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_CCM_SHA256 + # It is *strongly* recommended to generate unique DH parameters + # Generate them with: openssl dhparam -out /etc/haproxy/dhparams.pem 2048 + # ssl-dh-param-file /etc/haproxy/dhparams.pem + ssl-default-bind-ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305 + ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 @@ -913 +911 @@ Update the certificate path to match your file location. - 6. Configure systemd to use an environment file for HAProxy. The location depends on your Linux distribution. + 5. Configure systemd to use an environment file for HAProxy. The location depends on your Linux distribution. @@ -935 +933 @@ Edit `/lib/systemd/system/haproxy.service` and add the following line under the - 7. Create the environment file in the appropriate location for your system. + 6. Create the environment file in the appropriate location for your system. @@ -951 +949 @@ Replace `<CU user name>` and `<password>` with your CU credentials. - 8. Reload systemd configuration: + 7. Reload systemd configuration: @@ -955 +953 @@ Replace `<CU user name>` and `<password>` with your CU credentials. - 9. Start HAProxy with the CloudHSM TLS offload configuration: + 8. Start HAProxy with the CloudHSM TLS offload configuration: