Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 04 Nov 2013 09:58:35 -0800
From: Russ Allbery <eagle@...ie.org>
To: oss-security@...ts.openwall.com
Subject: Re: openssl default ciphers

Hanno Böck <hanno@...eck.de> writes:

> SSLCipherSuite HIGH:!MEDIUM:!LOW:!aNULL@...ENGTH
> should be fine. There are basically near zero browsers out there that
> should have any problems with that. Even dinosaurs like IE6 can work
> with this, you don't need "medium" ciphers as long as you don't want to
> make a site accessible to browser museums.

Just to data-point on compatibility, we've been using:

SSLProtocol all -SSLv2
SSLCipherSuite HIGH:MEDIUM:!ADH:!SSLv2:@STRENGTH

(not quite as strong as what you mention above; we should look at
changing) for all of Stanford's SSL web sites for years and years now, and
have never had a single complaint.

-- 
Russ Allbery (eagle@...ie.org)              <http://www.eyrie.org/~eagle/>

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.