Adding support for specifying cipher suits

[wargamez]

In the same way you have added support for minVersion = "VersionTLS12" by being able to set Environment Variable TRAEFIK_HTTPS_MIN_TLS, it would be great if you could add a TRAEFIK_HTTPS_CIPHERS that would add support for specifying an array of cipher suites like
CipherSuites = ["TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256","TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"]

As shown at https://docs.traefik.io/configuration/entrypoints/#specify-minimum-tls-version
A more awesome thing would be to support mozilla recommendations:
https://wiki.mozilla.org/Security/Server_Side_TLS
e.g TRAEFIK_HTTPS_CIPHERS_LEVEL = modern | intermediate| old

The reasoning is that the current defaults is vulnerable to SWEET32 attack, since it includes 3DES ciphers.

Ref: nmap -sV --script ssl-enum-ciphers -p 443 yourhostbehindtraefik.com

Thanks,
/E

[rawmind0]

Sure, nice feature. A PR would be really appreciated. :)

[justb81]

@rawmind0 @wargamez i'll have a look into this.

[justb81]

i'd like to introduce two new ENV vars:

• TRAEFIK_HTTPS_PROFILE = modern|intermediate|old, which sets ciphers and mintls according to the mozilla recommendations
• TRAEFIK_HTTPS_CIPHERS = TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, …, which overrides the profile-setting the same way, TRAEFIK_HTTPS_MIN_TLS does

so in most cases, you just set TRAEFIK_HTTPS_PROFILE=modern.

Question: @rawmind0 @wargamez Should we set the intermediate profile as default or nothing at all? Does somebody know what traefiks default ciphersuite is?

[Yivan]

Hello, what are the corresponding Traefik settings to Mozilla Modern please ?
Are the one specified here corresponding to modern profile ? : https://docs.traefik.io/configuration/entrypoints/#specify-minimum-tls-version
If yes it should be added to documentation.

What are the default ? (all cipher and no minversion ?). Maybe could be added to documentation too as it is security related.

Thanks.

[wargamez]

Has any of this been added? Can I now use TRAEFIK_HTTPS_PROFILE=modern ?