HaProxy - Does prefer-client-ciphers mean the client can choose a cipher not supported by a server?

KoenDG

1/2/24, 6:28 PM

Considering a setup like this:

global
    # intermediate configuration
    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
    ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets

The bind options set prefer-client-ciphers. The client can choose, but is that choice limits to my provided bind ciphers, or not?

The HaProxy documentation doesn't say: https://cbonte.github.io/haproxy-dconv/1.8/configuration.html#5.1-prefer-client-ciphers

396

1 + 0

ssl

haproxy

cipher

Score:2

Server

Håkan Lindqvist

1/2/24, 7:18 PM

This answer is not based on Haproxy specifically but general TLS behavior:

The TLS client and the TLS server each has a list of ciphers that it can support/accept, these lists are ordered by their respective preference.

During the TLS handshake, the client sends its list of supported ciphers, and the server then has to decide what to actually use.
As long as there is an overlap between their respective lists, it will be possible to pick a cipher that everyone supports and it will be possible to establish a connection.

However, even with such an overlap, the order of their respective lists (ie, their respective preference) may differ.

What this almost universally available setting (the name is different in different software, also often seen with the opposite perspective) determines whose preference should win.

For a long time the typical argument among server operators has been something along the lines "server side wins, don't let that silly client pick some weak cipher we have at the very end of our list" (unless it's absolutely necessary).
However, more recently there has been a movement towards "don't include any cipher we consider weak and let the client have their pick; low-end clients (IoT, lower end mobile devices, and similar) may benefit greatly from being able to pick ChaCha20 over AES".

TL;DR No, the chosen cipher will have to be one that is supported by both the client and the server or the connection will not be established, regardless whose preference wins based on that setting.

+ 1

KoenDG

1/3/24, 9:12 AM

Thank you for the clear explanation.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: HaProxy - Does prefer-client-ciphers mean the client can choose a cipher not supported by a server?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.