<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">I’d like to draw people’s attention to a patchset for bmcweb here:<o:p></o:p></p>
<p class="MsoNormal">https://gerrit.openbmc-project.xyz/#/c/openbmc/bmcweb/+/17390/<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This is updating the bmcweb cipher suites to more secure values, and in turn deprecating support for some older framework that we might have as clients. As stated in the patch, we are following OWASP “B” cipher suite recommendations, although
I would like to see us move to “A” in the near future. I have tested several browsers, and several OpenSSL versions, and they seem to work. I’m bringing attention to this to mention that if people see issues in HTTPS in the next week or so, they are likely
the result of this change, and to report them so we can get them resolved. The most likely culprit is going to be out of date crypto frameworks (think pyCrypto type) that don’t have support for SHA256. If we lose compatibility for anything important, we
need to get it identified so we can roll back the changes, or get frameworks up to date. In most cases, it will give a very unhelpful “Unable to make secure connection” or “No shared cipher suites” message, which is pretty cryptic if you don’t know what to
look for.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hopefully this goes off without a hitch, and this email was unnecessary, but in the case that I’ve made an error, hopefully this warning will save people some time.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">-Ed<o:p></o:p></p>
</div>
</body>
</html>