4 ms·
I have a bad habit of linking to HN posts and assuming that people understand I mean "look at the comments." The Cloudflare instructions break chrome? That is m
by dfc 13y ago
I have a bad habit of linking to HN posts and assuming that people understand I mean "look at the comments." The Cloudflare instructions break chrome? That is my bad, I have not verified them myself recently. I usually use the cloudflare settings or jacob's duraconf[1]. Thanks to joeyh's mr I usually have duraconf checked out on any machine that I use.
[1] https://github.com/ioerror/duraconf https://github.com/ioerror/duraconf
- jcampbell1 13y agoYes, the cloudflare advice does break chrome PFS. With the defaults, chrome shows: CAMELLIA_256_CBC, with SHA1 for message authentication and DHE_RSA as the key exchange mechanism. By changing to the suggestion in the comments, the encryption downgrades to: The connection is encrypted using RC4_128, with SHA1 for message authentication and RSA as the key exchange mechanism.
- dfc 13y agoYeah, I actually just noticed that cloudflare was using nginx so the qualys scan was not indicative of the cloudflare apache setup. I apologize I got distracted watching those genetic cars.
- newman314 13y agoSee my comment in the second link for what I use for nginx. I prefer explicitly stating ciphers to make sure only the ones I want presented are used