#989209 haproxy: Default /etc/haproxy/haproxy.cfg config file includes SSL config for 2.0.3 instead of 2.2.9

Package:
haproxy
Source:
haproxy
Description:
fast and reliable load balancing reverse proxy
Submitter:
Tim Small
Date:
2021-05-28 15:30:03 UTC
Severity:
normal
#989209#5
Date:
2021-05-28 15:03:54 UTC
From:
To:
After installing the version 2.2.9-1 Debian package, the default
/etc/haproxy/haproxy.cfg contains an SSL configuration excerpt in the
global section which has been generated with:

https://ssl-config.mozilla.org/#server=haproxy&server-version=2.0.3&config=intermediate

... which seems a little out of date.

For 2.2.9 / Bullseye, the URL (and any resulting config lines included
in haproyx.cfg) should probably be changed to:

https://ssl-config.mozilla.org/#server=haproxy&version=2.2.9&config=intermediate&openssl=1.1.1k

Potentially this could impact the security of haproxy configurations if
Debian users manually merge the configuration after upgrade, so maybe
this would be good to get merge before Bullseye ships.

Thanks!

Tim.
#989209#10
Date:
2021-05-28 15:20:56 UTC
From:
To:
 ❦ 28 mai 2021 16:03 +01, Tim Small:

I don't see any difference between the two configurations. Do you see any?