SSLCipherSuite

[Ian Young]

On 27 Jul 2012, at 21:04, Russell Beall <beall at usc.edu> wrote:

> Nice.  Thanks for this, this is what I was looking for.
> 
> The one question I would raise about this is that because it looks quite a bit stronger, have you experienced anything more than a trickle of users who are stuck with older browsers who end up unable to connect their browsers to a website configured that way?

I have heard of no such reports for the shibboleth.net deployments, but people using those aren't really representative.

On the other hand, I can tell you that we deployed a slightly modified version of that (missing the first two terms, i.e., just with RC4:HIGH:!MD5:!aNULL:!EDH:!EXPORT, which is equivalent on most systems) on the UK federation central discovery service a month or so back (after quite a lot of internal testing) and as far as I know we've had no reports of issues there either.

On reviewing this, I think I should probably have given you a couple of other lines of configuration from our recommendation as well:

   SSLProtocol -All +SSLv3 +TLSv1
   SSLHonorCipherOrder On
   SSLCipherSuite ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!EXPORT

The SSLProtocol one is obviously important too, and you probably already have that or something like it.  The cipher ordering thing only really has much effect when you have the two specific ciphers at the front, but as I say most systems don't support them anyway.

The UKf CDS deployment looks like this:

   SSLProtocol -All +SSLv3 +TLSv1
   SSLHonorCipherOrder On
   SSLCipherSuite RC4:HIGH:!MD5:!aNULL:!EDH:!EXPORT

That seems to get you most of the way there (we have some mod_ssl versioning issues which mean we can't do the full thing).

	-- Ian



-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4813 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20120727/56c427fc/attachment.bin