A roster of TLS cipher suites weaknesses

Re:A roster of TLS cipher suites weaknesses by IgorPartola on Friday November 15, 2013 @01:52PM (#6741339)

I really wish SSL Labs would provide a list of ciphers that actually passes their own test 100%. For example in nginx I have TLSv1 TLSv1.1 and TLSv1.2 enabled, with "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:AES128-SHA:RC4-SHA" for the cipher list. SSL Labs says that TLSv1.2 is not supported, and that I should enable forward secrecy recommending that I put ECDHE ciphers at the top of the list. Not being a security expert I have a really hard time deciphering what I am doing wrong with these two simple settings. (nginx version is 1.4.3).

[ Parent | on HN ]

Re:A roster of TLS cipher suites weaknesses by ivanr on Friday November 15, 2013 @02:03PM (#6741404)

[I am the author of SSL Labs.] I agree with you that SSL Labs currently does not help non-experts very much; the test is still focused on presenting the details, but without guidance. The next version should be very explicit about what should and should not be done.

As for your case, I propose that you follow my advice from the blog post I linked to earlier. It's much easier to do that then to find out exactly why the results are not as you expect.

[ Parent | on HN ]

Re:A roster of TLS cipher suites weaknesses by IgorPartola on Friday November 15, 2013 @02:06PM (#6741419)

I will give it a try. BTW, great service. Thank you very much for running it!

[ Parent | on HN ]