Is the httpd service configurable?

[SnakeByte]

If possible, I'd like to:

Disable TLS 1.0 and 1.1 as well as restrict the cipher suite.
Disable Secure Client-Initiated Renegotiation

Enable:
OCSP stapling,
Strict Transport Security (HSTS),
Public Key Pinning (HPKP)

but I'll take what I can get.

 

[RMerlin]

If possible, I'd like to:

Disable TLS 1.0 and 1.1 as well as restrict the cipher suite.
Disable Secure Client-Initiated Renegotiation

Enable:
OCSP stapling,
Strict Transport Security (HSTS),
Public Key Pinning (HPKP)

but I'll take what I can get.

Nothing of that is configurable. It's not a generic web server, it's a proprietary one designed for small embedded devices. The SSL handling is done by the custom mssl library.

 

[lancethepants]

You could always use something like nginx or stunnel to create a reverse SSL proxy to expose the httpd server.

 

[RMerlin]

You could always use something like nginx or stunnel to create a reverse SSL proxy to expose the httpd server.

Or NOT expose the httpd, because it's not very hardened in itself, and has received numerous security fixes over the past months. Use a VPN tunnel if you need to remotely access the router's httpd.

I already hardened SSL as much as possible for it. If your browser supports TLS 1.2, then it will use it as well as ECDH ciphers.

But having the best ciphers in the world is meaningless if there are regularly security holes in the daemon you are accessing.