SSLCipherSuite

[Ian Young]

On 27 Jul 2012, at 19:46, Russell Beall <beall at usc.edu> wrote:

> I am curious what the shib community would consider to be the ideal SSLCipherSuite setting for apache, either in front of an IdP, an SP, or both.

You could try this:

SSLCipherSuite ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!EXPORT

This is the recommendation we're giving UK federation members here:

http://www.ukfederation.org.uk/content/Documents/Setup2IdPApacheHttpd

It's closely based on the one worked out by Chad for the shibboleth.net sites, which is in turn based on some recommendations from www.ssllabs.com

> Would this be considered sufficient, or because this is security software and subject to more stringent standards, should this be tightened in some way, for instance, by removing the +LOW configuration?

I'd recommend using the ssllabs tester to see whether you're getting what you think you're getting.  This only works on port 443, alas:

https://www.ssllabs.com/ssltest/index.html

	-- Ian



-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4813 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20120727/b0e6b70b/attachment-0001.bin