Ensure that TrySetECDHNamedCurve is always called, enabling ECDHE ciphersuites
authorJeremy Barton <jbarton@microsoft.com>
Thu, 30 Aug 2018 07:48:13 +0000 (00:48 -0700)
committerGitHub <noreply@github.com>
Thu, 30 Aug 2018 07:48:13 +0000 (00:48 -0700)
commit6be9a8bb71f6cb8c70538918dc062bb35523bf6a
tree8be374aca9f4538816c67ada85ecf794f6f3785f
parent290fb1fdb4a622cc1eae37cebc26e97c84a9bbae
Ensure that TrySetECDHNamedCurve is always called, enabling ECDHE ciphersuites

Moves the call to TrySetECDHNamedCurve above the early abort when the server default protocols are selected.

This ensures that when SslStream is used as a TLS server that the ECDHE ciphersuites are available for "Perfect Forward Secrecy".

By using an SslStream-based TLS server and the openssl s_client utility as a client, verified that the ciphersuite went from ECDH-ECDSA-AES256-GCM-SHA384 to ECDHE-ECDSA-AES256-GCM-SHA384 (and AES256-GCM-SHA384 to ECDHE-RSA-AES256-GCM-SHA384 for RSA).

Commit migrated from https://github.com/dotnet/corefx/commit/18720f9b286770a08f59e866e4da220d3aadaf29
src/libraries/Native/Unix/System.Security.Cryptography.Native/pal_ssl.c