algo/roles/vpn/defaults/main.yml
Jack Ivanov 4ca8c03e3c New default cipher suite (#991)
* New ciphers enabled

* Update CHANGELOG.md

* Switch ecparam to secp384r1

* Change CertificateType to ECDSA384
2018-06-27 11:22:45 -04:00

32 lines
602 B
YAML

---
ipv6_support: false
domain: false
subjectAltName_IP: "IP:{{ IP_subject_alt_name }}"
openssl_bin: openssl
strongswan_enabled_plugins:
- aes
- gcm
- hmac
- kernel-netlink
- nonce
- openssl
- pem
- pgp
- pkcs12
- pkcs7
- pkcs8
- pubkey
- random
- revocation
- sha2
- socket-default
- stroke
- x509
ciphers:
defaults:
ike: aes256gcm16-prfsha512-ecp384!
esp: aes256gcm16-ecp384!
compat:
ike: aes256gcm16-prfsha512-ecp384,aes256-sha2_512-prfsha512-ecp384,aes256-sha2_384-prfsha384-ecp384!
esp: aes256gcm16-ecp384,aes256-sha2_512-prfsha512-ecp384!