fachinformatiker-wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.

====== HAProxy ======

<code>
haproxy -V -f haproxy.cfg -c            # check config file (verbose)
</code>

===== pfSense =====

==== Settings ====

** Global Advanced pass thru -> Custom options **
<code>
tune.ssl.default-dh-param 4096
ssl-default-bind-options ssl-min-ver TLSv1.2 prefer-client-ciphers
ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-bind-ciphers ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES256:ECDH+AES128:!aNULL:!SHA1:!AESCCM
ssl-default-server-options ssl-min-ver TLSv1.2
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-server-ciphers ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES256:ECDH+AES128:!aNULL:!SHA1:!AESCCM
</code>

==== Frontend ====

**Advanced settings -> Advanced pass thru**
<code>
http-response set-header Strict-Transport-Security "max-age=16000000; preload;"
</code>