{"action":"created","issue":{"url":"https://api.github.com/repos/crystal-lang/crystal/issues/2671","repository_url":"https://api.github.com/repos/crystal-lang/crystal","labels_url":"https://api.github.com/repos/crystal-lang/crystal/issues/2671/labels{/name}","comments_url":"https://api.github.com/repos/crystal-lang/crystal/issues/2671/comments","events_url":"https://api.github.com/repos/crystal-lang/crystal/issues/2671/events","html_url":"https://github.com/crystal-lang/crystal/pull/2671","id":157343227,"number":2671,"title":"TLS server improvements","user":{"login":"ysbaddaden","id":47380,"avatar_url":"https://avatars.githubusercontent.com/u/47380?v=3","gravatar_id":"","url":"https://api.github.com/users/ysbaddaden","html_url":"https://github.com/ysbaddaden","followers_url":"https://api.github.com/users/ysbaddaden/followers","following_url":"https://api.github.com/users/ysbaddaden/following{/other_user}","gists_url":"https://api.github.com/users/ysbaddaden/gists{/gist_id}","starred_url":"https://api.github.com/users/ysbaddaden/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ysbaddaden/subscriptions","organizations_url":"https://api.github.com/users/ysbaddaden/orgs","repos_url":"https://api.github.com/users/ysbaddaden/repos","events_url":"https://api.github.com/users/ysbaddaden/events{/privacy}","received_events_url":"https://api.github.com/users/ysbaddaden/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-05-28T15:16:32Z","updated_at":"2016-05-28T17:38:00Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/crystal-lang/crystal/pulls/2671","html_url":"https://github.com/crystal-lang/crystal/pull/2671","diff_url":"https://github.com/crystal-lang/crystal/pull/2671.diff","patch_url":"https://github.com/crystal-lang/crystal/pull/2671.patch"},"body":"This allows to configure an OpenSSL context suitable for HTTP2. Most specifically we now can:\r\n\r\n- Select the SSL/TLS method (sslv2, sslv3, tls1, tls1.1, tls1.2 (default));\r\n- Configure SSL options & modes;\r\n- Configure ciphers to allow/disable;\r\n- Generate an ECDH key to enable EECDH ciphers (only `NID_X9_62_prime256v1` is supported, other curves may work too);\r\n- Negotiate the protocol through ALPN (ie. `h2` for HTTP2/TLS negotiation with browsers) which requires OpenSSL 1.0.2+ (ie. Ubuntu Xenial LTS).\r\n\r\nIt also features a default SSL context suitable for HTTP/1 that should be strong enough (AFAIK). It only misses certificates to be used:\r\n\r\n```crystal\r\nssl_context = HTTP::Server.default_ssl_context\r\nssl_context.certificate_chain = \"/path/to/server.crt\"\r\nssl_context.private_key = \"/path/to/server.key\"\r\n```\r\n\r\nThen for HTTP2:\r\n\r\n```crystal\r\nssl_context.alpn_protocol = \"h2\"\r\n```\r\n\r\nPlease note that I enabled RC4 in the list of CIPHERS for HTTP. This is only required to support Internet Explorer 8. We may want to disable RC4 by default, and have a way to enable it on demand?\r\n\r\n```crystal\r\nHTTP::Server.default_ssl_context(rc4: true)\r\n```"},"comment":{"url":"https://api.github.com/repos/crystal-lang/crystal/issues/comments/222320319","html_url":"https://github.com/crystal-lang/crystal/pull/2671#issuecomment-222320319","issue_url":"https://api.github.com/repos/crystal-lang/crystal/issues/2671","id":222320319,"user":{"login":"asterite","id":209371,"avatar_url":"https://avatars.githubusercontent.com/u/209371?v=3","gravatar_id":"","url":"https://api.github.com/users/asterite","html_url":"https://github.com/asterite","followers_url":"https://api.github.com/users/asterite/followers","following_url":"https://api.github.com/users/asterite/following{/other_user}","gists_url":"https://api.github.com/users/asterite/gists{/gist_id}","starred_url":"https://api.github.com/users/asterite/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/asterite/subscriptions","organizations_url":"https://api.github.com/users/asterite/orgs","repos_url":"https://api.github.com/users/asterite/repos","events_url":"https://api.github.com/users/asterite/events{/privacy}","received_events_url":"https://api.github.com/users/asterite/received_events","type":"User","site_admin":false},"created_at":"2016-05-28T17:38:00Z","updated_at":"2016-05-28T17:38:00Z","body":"Awesome, thanks!\r\n\r\nI personally know nothing about OpenSSL so I don't feel capable of deciding whether this is good or not. That said, we need someone who can take care of OpenSSL related stuff. We already have others PR and issues related to this:\r\n\r\n* https://github.com/crystal-lang/crystal/issues/1710\r\n* https://github.com/crystal-lang/crystal/pull/2180\r\n* https://github.com/crystal-lang/crystal/pull/2343\r\n\r\nI remember @waj also told me he doesn't know much about it. We could of course take some time to learn it, but we can't just apply this to every piece of the standard library, it would take a lot of time! :-)\r\n\r\n@ysbaddaden Since you are sending this PR, would you like to take this role? Or maybe you and @jhass . Just verify that PR related to OpenSSL are fine according to your experience. I will take a look too, but don't wait for my confirmation to merge. Since there's still more stuff to do until we reach 1.0 it's better to move forward, even slowly. Before releasing 1.0 we can review all OpenSSL related functionality and make sure it works well and has a good API.\r\n\r\nOtherwise, if someone else wants to take this role, let us know."}}
{"actor":{"display_login":"asterite"}}