Merge "Use only approved TLS1.2 FIPS cipher suites (libvirt)"
diff --git a/nova/compute/libvirt/ssl/init.yml b/nova/compute/libvirt/ssl/init.yml
index 4523183..6e29e07 100644
--- a/nova/compute/libvirt/ssl/init.yml
+++ b/nova/compute/libvirt/ssl/init.yml
@@ -16,6 +16,7 @@
cert_file: ${_param:libvirtd_server_ssl_cert_file}
ca_file: ${_param:libvirtd_ssl_ca_file}
allowed_dn_list: ${_param:nova_compute_libvirt_allowed_dn_list}
+ priority: "SECURE256:-VERS-ALL:+VERS-TLS1.2:-KX-ALL:+ECDHE-RSA:+ECDHE-ECDSA:-CIPHER-ALL:+AES-256-GCM:+AES-256-CBC:-MAC-ALL:+AEAD:+SHA384"
client:
key_file: ${_param:libvirtd_client_ssl_key_file}
cert_file: ${_param:libvirtd_client_ssl_cert_file}