Disable weak ciphers with cherrypy (python 2) -

i'm using cherrypy 3.8.0 python 2 use ssl/tls using pyopenssl.

i want disable ssl3 avoid poodle (or other weak ciphers).

here's have far:

  server_config={           'server.socket_port': 443,           'server.ssl_module':'pyopenssl',           'server.ssl_certificate':'/path/myserver.crt',           'server.ssl_private_key':'/path/myserver.key',       } 

this similar this question python 2 , pyopenssl.

how can specify or exclude specific ciphers? thanks!

to disable ssl3, should set ssl_context variable rather accepting default. here's example using python's built-in ssl module (in lieu of built-in cherrypy ssl module).

import cherrypy openssl import ssl  ctx = ssl.context(ssl.sslv23_method) ctx.set_options(ssl.op_no_sslv2 | ssl.op_no_sslv3)  ...  server_config = {     'server.socket_host': '0.0.0.0',     'server.socket_port': 443,     'server.ssl_context': ctx }  cherrypy.config.update(server_config) 

where in case, ssl openssl module.

it's worth noting beginning in python 3.2.3, ssl module disables weak ciphers default.

furthermore, can set ciphers want with

ciphers = {     'dhe-rsa-ae256-sha',     ...     'rc4-sha' }  ctx.set_cipher_list(':'.join(ciphers)) 

if you're using cherrypywsgiserver web.wsgiserver module, set default ciphers with

cherrypywsgiserver.ssl_adapter.context.set_cipher_list(':'.join(ciphers)) 

lastly, here sources (asking similar questions) may want at:

• how block ssl protocols in favor of tls?
• https://review.cloudera.org/r/4739/diff/
• http://roadha.us/2014/10/disable-sslv3-avoid-poodle-attack-web-py/
• http://blog.gosquadron.com/use-tls
• http://www.experts-exchange.com/questions/28073251/disable-weak-ssl-cipher-on-cherrypy-pyopenssl-windows-2008-server.html