Date: Mon, 04 Nov 2013 09:58:35 -0800 From: Russ Allbery <eagle@...ie.org> To: oss-security@...ts.openwall.com Subject: Re: openssl default ciphers Hanno Böck <hanno@...eck.de> writes: > SSLCipherSuite HIGH:!MEDIUM:!LOW:!aNULL@...ENGTH > should be fine. There are basically near zero browsers out there that > should have any problems with that. Even dinosaurs like IE6 can work > with this, you don't need "medium" ciphers as long as you don't want to > make a site accessible to browser museums. Just to data-point on compatibility, we've been using: SSLProtocol all -SSLv2 SSLCipherSuite HIGH:MEDIUM:!ADH:!SSLv2:@STRENGTH (not quite as strong as what you mention above; we should look at changing) for all of Stanford's SSL web sites for years and years now, and have never had a single complaint. -- Russ Allbery (eagle@...ie.org) <http://www.eyrie.org/~eagle/>
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.