bump tls version, enforce strong ciphers

2026-01-23 19:32:09 -07:00
parent 2b1a5ee3f9
commit 820b458037
1 changed files with 2 additions and 0 deletions
--- a/ansible/roles/openldap_server/tasks/tls.yaml
+++ b/ansible/roles/openldap_server/tasks/tls.yaml
@@ -5,6 +5,8 @@
    attributes:
      olcTLSCertificateFile: "{{ ldap_cert_path }}"
      olcTLSCertificateKeyFile: "{{ ldap_key_path }}"
+      olcTLSProtocolMin: "3.3"    # TLS 1.2+
+      olcTLSCipherSuite: HIGH:!aNULL:!MD5
  args:
    server_uri: ldapi:///
    sasl_mech: EXTERNAL