default_ciphersuites (open)

These ciphersuite settings are taken from the current internet.nl requirements which in turn is based on appendix B of NCSC-NL's guidelines.

Good [TLS 1.3]:

TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256

Sufficient [TLS 1.3]:

TLS_AES_128_CCM_SHA256 TLS_AES_128_GCM_SHA256

Sufficient [TLS 1.2]:

TLS_ECDHE_ECDSA_WITH_AES_128_CCM TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_CCM TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256

Openssl calls these:

ECDHE-ECDSA-AES128-CCM ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-CCM ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305

It seems our webhare/proxy currently lacks support for TLS_AES_128_CCM_SHA256 - so we'll just drop that one

LOADLIB "wh::internet/tcpip.whlib";

CONSTANT STRING default_ciphersuites