# DANE/OpenSSL - ciphers option
SERVER=
-OPT=
+LIST=
.include DIR/aux-var/tls_conf_prefix
# Permit two specific ciphers
tls_require_ciphers = ECDHE-RSA-CAMELLIA256-SHA384:ECDHE-RSA-AES256-GCM-SHA384
+# Force TLS1.2 so that the ciphers choice works
+
+.ifdef _OPT_OPENSSL_NO_TLSV1_3_X
+openssl_options = +no_tlsv1_3
+.endif
+
# ----- Routers -----
begin routers
client:
driver = dnslookup
condition = ${if eq {SERVER}{}}
+ ignore_target_hosts = <; 0::0/0
dnssec_request_domains = *
self = send
transport = send_to_server
# Some commonly-available cipher, we hope
tls_require_ciphers = ECDHE-RSA-AES256-GCM-SHA384
- dane_require_tls_ciphers = OPT
+ dane_require_tls_ciphers = LIST
# ----- Retry -----
begin retry