libressl:chacha20

Currently LibreSSL is the only way to use ports to add ChaCha20/Poly1305 support

The www/apache24 port was initially patched to work with LibreSSL, latest versions of Apache 2.4 come with LibreSSL support included.

SSLProtocol All -SSLv2 -SSLv3 -TLSv1.1
SSLHonorCipherOrder on
SSLCipherSuite "EECDH+CHACHA20 EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH
+aRSA+SHA256 EECDH EDH+aRSA !RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS"

As of version 2.4.17 it also supports HTTP/2 with the mod_http2 module.

The www/nginx port works with LibreSSL without issues.

ssl_ciphers         EECDH+CHACHA20:EECDH+AES256:RSA:EECDH+AES128:RSA+AES128:RSA+AES256:!MD5;
ssl_prefer_server_ciphers on;

As of version 1.9.5 it also supports HTTP/2.

There's currently an issue with ChaCha20/Poly1305 and Firefox when HTTP/2 is used. You may wish to rearrange the chipherlist so ChaCha20 is listed 'after' EECDH+AES256

No known ChaCha20/Poly1305 or HTTP/2 compatibility issues at the moment.

  • libressl/chacha20.txt
  • Last modified: 2018/03/18 07:53
  • by MarkLinimon