On 4/20/2021 9:48 AM, @lbutlr wrote:
If I define SSLCipherSuite DEFAULT will apache show the ciphers that are defined by openSSL and will be used? Is this the best way to go, or should I specifically list TLSv1.2 and TLS1.3?The complete list of ciphers that openssl supports numbers 60 and still
includes some 14 TLSv1 ciphers like PSK-AES128-CBC-SHA256, among others.
Trying to search on recommendations comes up with a lot of "use these settings to allow IE 6.0" which is of literally no. interest to me at all. This is what I am looking at using: Protocols h2 h2c http/1.1 SSLCipherSuite DEFAULT SSLProtocol all -TLSv1.1 -TLSv1 -SSLv2 -SSLv3 But I may relent on TLSv1/1.1 after checking logs. I think that if I set SSLCipherSuite DEFAULT and SSLProtocol to not allow the older TLS and SSL that will provide ciphers and security that are supported by current browsers and if I allow TLSv1 it should support old browsers going back more than a decade, yes?
Per https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslciphersuite Setting SSLCipherSuite to DEFAULT is dependent on OpenSSL version.I believe running 'openssl ciphers' will list your openssl installation's default cipher list which I am assuming is what SSLCipherSuite set to DEFAULT would use, but I'm guessing. You'd have to confirm that.
I've always referenced https://wiki.mozilla.org/Security/Server_Side_TLS as a decent starting point. Intermediate is usually a pretty good starting point for a public web server. Then watching for any cipher-based vulnerabilities that are announced or reported by any vulnerability testing you might have performed.
https://www.ssllabs.com/ssltest/ is a pretty nice site to check on your httpd SSL configs. Jim --------------------------------------------------------------------- To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx
|