Hi,
we are using OPNWAF in different installations already. I just came across an issue regarding the outgoing connection from OPNSense to the backend server, that I could solve by disabling the backend certificate checks. But I´d like to know, how I would configure/adapt the allowed SSL Ciphers to the backend system. Just imagine there is a pretty old server in the backend, that runs on TLSv1 or maybe an even older SSL/TLS Protocol or on the other Hand I want to only allow specific ciphers etc..
Where would I be able to correctly set this? Can this be done in the GUI or would I have to configure this on the CLI somehow (using templates)? As far as I researched, probably this can be done with the apache directive "SSLProxyCipherSuite"....?!
Thanks.
Sebastian
Hello,
you can use this folder to import custom configurations:
# /usr/local/etc/apache24/includes-user
These are imported before the vhost configuration, so you can globally change settings e.g. creating a file called "ssl.conf" and then setting your custom parameters into it.
Quote from: Monviech (Cedrik) on Today at 11:24:39 AMHello,
you can use this folder to import custom configurations:
# /usr/local/etc/apache24/includes-user
These are imported before the vhost configuration, so you can globally change settings e.g. creating a file called "ssl.conf" and then setting your custom parameters into it.
Thanks for that. Is this also upgrade resistant or would I need to have a look at templates?
We added that path to be upgrade resistant and user owned.
No templates generate anything in those folders.
What you do in there is not synchronized in HA or in any backups though.