If You Can Read This, You're SNIing

Re:If You Can Read This, You're SNIing by tombrossman on Sunday May 11, 2014 @01:05PM (#7729180)

Agreed. You can probably drop SSL connections in favour of TLS only if you do this, too. I've done this on my work and personal sites and everything works fine for modern browsers.

For example, the config for your Nginx server block can go like this, with no need to support SSL at all.

> ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

I realise this excludes some traffic and I'm okay with it.

[ Parent | on HN ]

Re:If You Can Read This, You're SNIing by markuskobler on Sunday May 11, 2014 @03:41PM (#7729682)

I have taken exactly the same stance which has the added benefit you can also drop the vulnerable RC4 cyphers.

https://wiki.mozilla.org/Security/Server_Side_TLS#RC4_weakne...

[ Parent | on HN ]

Re:If You Can Read This, You're SNIing by yuhong on Thursday May 22, 2014 @09:14PM (#7787539)

Yep, if you are requiring SNI, SSLv3 might as well be disabled as SNI will never work with it.

[ Parent | on HN ]