EVOLUTION-MANAGER

Edit File: gsi.conf

# As of August 2018, TLSv1.2 is the default TLS protocol version. # Minimum TLS protocol version. One of TLS1_2_VERSION, TLS1_VERSION_DEPRECATED, # TLS1_1_VERSION_DEPRECATED, or 0 for the default. Invalid values will use # the default. SSLv3 and below are disabled. MIN_TLS_PROTOCOL=TLS1_VERSION_DEPRECATED # Maximum TLS protocol version. One of TLS1_2_VERSION, TLS1_VERSION_DEPRECATED, # TLS1_1_VERSION_DEPRECATED, or 0 for the highest supported version. Invalid # values will use the highest supported version. SSLv3 and below are disabled. MAX_TLS_PROTOCOL=0 # GSSAPI Name compatibility mode when trying to determine # if a host certificate is legitimate. GSI predates RFC2818, # so there are some old, less-secure, practices by default. # The different modes are: # STRICT_GT2: # Strictly backward-compatible with GT 2.0 name matching. # X.509 subjectAltName values are ignored. Names with # hyphens are treated as wildcarded such that # host-ANYTHING.example.com will match a certificate named # host.example.com. The name matching will rely on canonical # host (as resolved via getnameinfo) name associated with # a connection's IP addresses. # STRICT_RFC2818: # Support RFC 2818 server identity processing. Hyphen # characters are treated as normal part of a host name. # dnsName and ipAddress subjectAltName extensions are matched # against the host and port passed to GSSAPI. If subjectAltName # is present, X.509 SubjectName is ignored. # HYBRID: # Support a hybrid of the two previous name matching algorithms, # liberally matching both hyphen wildcards, canonical names # associated with IP addresses, and subjectAltName extensions. # This has been the default since GT 4.2 NAME_COMPATIBILITY=STRICT_RFC2818 # OpenSSL Cipher List. This is a preference-ordered list of OpenSSL cipher # names in CIPHER LIST FORMAT specified in ciphers(1). Disregarded and # 'eNULL:ALL:!COMPLEMENTOFDEFAULT' used instead, if GSS_C_CONF_FLAG not set # by the application. CIPHERS=HIGH # If true, when choosing a cipher, a server will use its own preferred # order instead of the cipher order presented by the client. When not set, the # SSL server will always follow the clients preferences. SERVER_CIPHER_ORDER=true # If true, when computing a message integrity check, use the original # implementation, which inspects internal OpenSSL structures. Otherwise, # use keying material and sequence counters in the GSSAPI structures only. # The true setting is only available for OpenSSL < 1.1.0 BACKWARD_COMPATIBLE_MIC=true # If true, when verifying a message integrity check, accept MICs generated # using the original implementation, which inspects internal OpenSSL # structures. Otherwise, only use the new code which relies on use keying # material and sequence counters in the GSSAPI structures only. # The true setting is only available for OpenSSL < 1.1.0 ACCEPT_BACKWARD_COMPATIBLE_MIC=true # If set to a non-root username, then files owned by that user are allowed # to own credentials used by the root user VHOST_CRED_OWNER=root