Re:Why isn't HTTPS everywhere yet?
by nailer on Tuesday January 19, 2016 @06:18PM
(#10934879)
> I would love a -secure flag to just use the most secure option of the current version of the software even at the cost of X years of backward compatibility at the tool/client/browser level.
How high HIGH is depends on your version of openssl, ie, you probably don't want it for, say RHEL 5's openssl. Which (openssl has a long lifecycle, LTS Linux distros extend it further) some places may still be using.
A better implementation of the same concept is Mozilla's SSL Config Generator (which is what CertSimple point customers to - we also maintain the node port): it has Modern/Intermediate/Old with a clear idea of the compatibility you're losing with each: https://mozilla.github.io/server-side-tls/ssl-config-generat...
> ssl_ciphers SECURE;
That's actually pretty close to nginx's default (unpatched) config (http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_c...), except openssl calls it HIGH.
ssl_ciphers HIGH:!aNULL:!MD5;
How high HIGH is depends on your version of openssl, ie, you probably don't want it for, say RHEL 5's openssl. Which (openssl has a long lifecycle, LTS Linux distros extend it further) some places may still be using.
https://www.openssl.org/docs/manmaster/apps/ciphers.html
A better implementation of the same concept is Mozilla's SSL Config Generator (which is what CertSimple point customers to - we also maintain the node port): it has Modern/Intermediate/Old with a clear idea of the compatibility you're losing with each: https://mozilla.github.io/server-side-tls/ssl-config-generat...