mirror of
https://git.anonymousland.org/anonymousland/synapse-product.git
synced 2024-09-09 13:42:02 +00:00
Don't create server contexts when TLS is disabled
we aren't going to use them anyway.
This commit is contained in:
parent
086f6f27d4
commit
9645728619
1
changelog.d/4617.misc
Normal file
1
changelog.d/4617.misc
Normal file
@ -0,0 +1 @@
|
|||||||
|
Don't create server contexts when TLS is disabled
|
@ -214,6 +214,11 @@ def refresh_certificate(hs):
|
|||||||
disk and updating the TLS context factories to use them.
|
disk and updating the TLS context factories to use them.
|
||||||
"""
|
"""
|
||||||
hs.config.read_certificate_from_disk()
|
hs.config.read_certificate_from_disk()
|
||||||
|
|
||||||
|
if hs.config.no_tls:
|
||||||
|
# nothing else to do here
|
||||||
|
return
|
||||||
|
|
||||||
hs.tls_server_context_factory = context_factory.ServerContextFactory(hs.config)
|
hs.tls_server_context_factory = context_factory.ServerContextFactory(hs.config)
|
||||||
|
|
||||||
if hs._listening_services:
|
if hs._listening_services:
|
||||||
|
@ -43,8 +43,6 @@ class ServerContextFactory(ContextFactory):
|
|||||||
logger.exception("Failed to enable elliptic curve for TLS")
|
logger.exception("Failed to enable elliptic curve for TLS")
|
||||||
context.set_options(SSL.OP_NO_SSLv2 | SSL.OP_NO_SSLv3)
|
context.set_options(SSL.OP_NO_SSLv2 | SSL.OP_NO_SSLv3)
|
||||||
context.use_certificate_chain_file(config.tls_certificate_file)
|
context.use_certificate_chain_file(config.tls_certificate_file)
|
||||||
|
|
||||||
if not config.no_tls:
|
|
||||||
context.use_privatekey(config.tls_private_key)
|
context.use_privatekey(config.tls_private_key)
|
||||||
|
|
||||||
# https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
|
# https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
|
||||||
|
Loading…
Reference in New Issue
Block a user