Majic Ansible Roles mandates use of TLS in all services exposed over network. All relevant roles also provide ability to specify what TLS ciphers should be allowed in specific service, coming with a fairly secure defaults.

The defaults have become somewhat outdated, however, and need to be updated.

The following should be done:

• Update the ldap_server, mail_server, and web_server roles.
  • Update defaults for the TLS ciphers parameters.
  • Drop use of any insecure algorithms from the parameters.
  • Improve tests by testing against all possible ciphers (e.g. be more precise in what is allowed and not allowed).
• Update role reference documentation.
• Update release notes.