From edd6f02273c58bfe39a978dd5c7b8765aae0b886 Mon Sep 17 00:00:00 2001 From: Roger Dingledine Date: Sat, 9 Mar 2013 17:16:11 -0500 Subject: randomize SSLKeyLifetime by default resolves ticket 8443. --- src/or/router.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'src/or/router.c') diff --git a/src/or/router.c b/src/or/router.c index c9c35f613..211366351 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -659,6 +659,10 @@ router_initialize_tls_context(void) else if (!strcasecmp(options->TLSECGroup, "P224")) flags |= TOR_TLS_CTX_USE_ECDHE_P224; } + if (!lifetime) { /* we should guess a good ssl cert lifetime */ + /* choose between 1 and 365 days */ + lifetime = 1*24*3600 + crypto_rand_int(364*24*3600); + } /* It's ok to pass lifetime in as an unsigned int, since * config_parse_interval() checked it. */ -- cgit v1.2.3