What compatibility trade-offs do we need to make in order to use a hardened SSL config for Nginx?
Posted
by
nathan.f77
on Server Fault
See other posts from Server Fault
or by nathan.f77
Published on 2013-11-09T00:01:53Z
Indexed on
2013/11/09
4:00 UTC
Read the original article
Hit count: 496
I found some hardened SSL settings in github.com/ioerror/duraconf.
Here is the header from the config:
This is an example of a high security, somewhat compatible SSLv3 and TLSv1 enabled HTTPS proxy server. The server only allows modes that provide perfect forward secrecy; no other modes are offered. Anonymous cipher modes are disabled. This configuation does not include the HSTS header to ensure that users do not accidentally connect to an insecure HTTP service after their first visit.
It only supports strong ciphers in PFS mode:
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
# Only strong ciphers in PFS mode
ssl_ciphers ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA;
ssl_protocols SSLv3 TLSv1;
If we were to use these settings on our website, what does "somewhat compatible" mean? For example, would IE6 still be able to connect?
© Server Fault or respective owner
