For nginx 1.1.19-1ubuntu0.2 on Ubuntu 12.04 the following config line will get you that green 'yes' for perfect forward secrecy: ssl_ciphers ECDHE-RSA-RC4-SHA:

For nginx 1.1.19-1ubuntu0.2 on Ubuntu 12.04 the following config line will get you that green 'yes' for perfect forward secrecy: ssl_ciphers ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:RC4:HIGH:!aNULL:!MD5:-LOW:-SSLv2:-EXP; You can test with a pair of terminals before you go bouncing your server (via [0]): openssl s_server -accept 8888 -cert mywebsite.com.pem -pass stdin -cipher ECDHE-RSA-RC4-SHA <hit enter a few times> openssl s_client -connect 127.0.0.1:8888 -cipher ECDHE-RSA-RC4-SHA I don't know what the proper way to get rid of RC4 is. [0] http://baudehlo.wordpress.com/2013/06/24/setting-up-perfect-forward-secrecy-for-nginx-or-stud/ http://baudehlo.wordpress.com/2013/06/24/setting-up-perfect-...