diff options
| author | Richard van der Hoff <richard@matrix.org> | 2019-02-11 21:34:19 +0000 |
|---|---|---|
| committer | Richard van der Hoff <richard@matrix.org> | 2019-02-11 21:34:19 +0000 |
| commit | 15272f837c42e003ade116ca0f1c239a29ebfb93 (patch) | |
| tree | 20aeb74d19c8713e557f592004a3fefba34ee8d5 /synapse | |
| parent | Merge branch 'rav/tls_config_logging_fixes' into rav/tls_cert/work (diff) | |
| parent | Don't create server contexts when TLS is disabled (diff) | |
| download | synapse-15272f837c42e003ade116ca0f1c239a29ebfb93.tar.xz | |
Merge branch 'rav/no_create_server_contexts_if_no_tls' into rav/tls_cert/work
Diffstat (limited to '')
| -rw-r--r-- | synapse/app/_base.py | 5 | ||||
| -rw-r--r-- | synapse/crypto/context_factory.py | 4 |
2 files changed, 6 insertions, 3 deletions
diff --git a/synapse/app/_base.py b/synapse/app/_base.py index 6d72de1daa..6b3cb61ae9 100644 --- a/synapse/app/_base.py +++ b/synapse/app/_base.py @@ -214,6 +214,11 @@ def refresh_certificate(hs): disk and updating the TLS context factories to use them. """ hs.config.read_certificate_from_disk() + + if hs.config.no_tls: + # nothing else to do here + return + hs.tls_server_context_factory = context_factory.ServerContextFactory(hs.config) if hs._listening_services: diff --git a/synapse/crypto/context_factory.py b/synapse/crypto/context_factory.py index 286ad80100..85f2848fb1 100644 --- a/synapse/crypto/context_factory.py +++ b/synapse/crypto/context_factory.py @@ -43,9 +43,7 @@ class ServerContextFactory(ContextFactory): logger.exception("Failed to enable elliptic curve for TLS") context.set_options(SSL.OP_NO_SSLv2 | SSL.OP_NO_SSLv3) context.use_certificate_chain_file(config.tls_certificate_file) - - if not config.no_tls: - context.use_privatekey(config.tls_private_key) + context.use_privatekey(config.tls_private_key) # https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/ context.set_cipher_list( |