CipherString = @SECLEVEL=3:kEECDH:kEDH:kPSK:kDHEPSK:kECDHEPSK:kRSAPSK:-kRSA:-aDSS:-CHACHA20:-3DES:!DES:!RC4:!RC2:!IDEA:-SEED:!eNULL:!aNULL:-SHA1:!MD5:-SHA384:-CAMELLIA:-ARIA:-AESCCM8
Ciphersuites = TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_SHA256
TLS.MinProtocol = TLSv1.2
TLS.MaxProtocol = TLSv1.3
DTLS.MinProtocol = DTLSv1.2
DTLS.MaxProtocol = DTLSv1.2
SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:ed25519:ed448:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:RSA+SHA256:RSA+SHA384:RSA+SHA512:?ecdsa_brainpoolP256r1_sha256:?ecdsa_brainpoolP384r1_sha384:?ecdsa_brainpoolP512r1_sha512
Groups = *secp256r1:secp384r1:secp521r1:ffdhe3072:ffdhe4096:?brainpoolP512r1tls13:brainpoolP512r1:?brainpoolP384r1tls13:brainpoolP384r1:?brainpoolP256r1tls13:brainpoolP256r1

[req]
default_bits = 3072

[openssl_init]
alg_section = evp_properties

[evp_properties]
rh-allow-sha1-signatures = no
