SSLCipherSuite

[Cantor, Scott]

On 7/27/12 2:46 PM, "Russell Beall" <beall at usc.edu> wrote:

>I am curious what the shib community would consider to be the ideal
>SSLCipherSuite setting for apache, either in front of an IdP, an SP, or
>both.

Dunno, but I'm interested in what you find out. ;-)

>A current default linux installation has ssl.conf with the following:
>SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
>
>Would this be considered sufficient, or because this is security software
>and subject to more stringent standards, should this be tightened in some
>way, for instance, by removing the +LOW configuration?

The actual string used in the SP for making TLS connections currently is:

ALL:!aNULL:!LOW:!EXPORT:!SSLv2

It seems to follow that using the same value on any vhosts for SOAP would
be compatible. Which is not to say it couldn't be made stronger.


-- Scott