Recommended TLS Ciphers for Traefik
Edit: as noted in the issue linked below, the config-generator has been fixed.
I found this question while researching the cipher suites for Traefik. So, for future reference, and people who have tried the generator but ran into problems:
I found the ssl-config page of Mozilla, that Rui Martins mentioned as well. This works fine, except for the last four entries.
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
Are not recognized by Traefik as valid cipher suites.
I checked the Go documentation, and found that the cipher suites aren't mentioned there either. Relatively close alternatives were mentioned however: https://godoc.org/crypto/tls#pkg-constants
So I replaced the values as follows:
+-----------------------------------------------+----------------------------------------+
| Old Value | New Value |
+-----------------------------------------------+----------------------------------------+
| TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 | TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 |
+-----------------------------------------------+----------------------------------------+
| TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 | TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 |
+-----------------------------------------------+----------------------------------------+
| TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 |
+-----------------------------------------------+----------------------------------------+
| TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 |
+-----------------------------------------------+----------------------------------------+
Note the removed _SHA256
for the first two entries, and the added EC
for the last two.
This works fine, but is not a solution for the core problem. As I do not have a lot of knowledge or experience in cipher suites, I have filed a bug report with Mozilla about their ssl-config generation for Traefik. ( https://github.com/mozilla/ssl-config-generator/issues/52 )
You can use this page to generate your traefik config: https://ssl-config.mozilla.org/#server=traefik&server-version=1.7.12&config=intermediate
# generated 2019-07-17, https://ssl-config.mozilla.org/#server=traefik&server-version=1.7.12&config=intermediate
defaultEntryPoints = ["http", "https"]
[entryPoints]
[entryPoints.http]
address = ":80"
[entryPoints.http.redirect]
entryPoint = "https"
[entryPoints.https]
address = ":443"
[entryPoints.https.tls]
minVersion = "VersionTLS12"
cipherSuites = [
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
"TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
"TLS_DHE_RSA_WITH_AES_128_GCM_SHA256"
]
[[entryPoints.https.tls.certificates]]
certFile = "/path/to/signed_cert_plus_intermediates"
keyFile = "/path/to/private_key"