4 ms·
I asked my local SSL expert, and he mentioned: the list the client sends is just a preference list; the server can choose what it wants. For example, nginx by
by evmar 13y ago
I asked my local SSL expert, and he mentioned: the list the client sends is just a preference list; the server can choose what it wants.
For example, nginx by default[1] specifies an OpenSSL cipher list of HIGH:!aNULL:!MD5, which you can examine by running
$ openssl ciphers 'HIGH:!aNULL:!MD5'
You'll see neither RC4 nor MD5 in that list. (You will if you run a plain "openssl ciphers", so you can see openssl knows about them but the config turns them off.)
(I'm an SSL newbie, please correct any mistakes I've made in the above.)
[1] http://wiki.nginx.org/HttpSslModule#ssl_ciphers http://wiki.nginx.org/HttpSslModule#ssl_ciphers
- ge0rg 13y agoYou are right, the final choice of the algorithm is with the server. I am not sure though if it is possible to give other ciphers a higher priority on the server without completely disabling RC4 (which is still better than no encryption / no connection). Edit: effhaa mentioned http://httpd.apache.org/docs/current/mod/mod_ssl.html#sslhonorcipherorder http://httpd.apache.org/docs/current/mod/mod_ssl.html#sslhon... for apache in another post.
- mnordhoff_ 13y agoNginx has an equivalent preference, ssl_prefer_server_ciphers on. (Scroll down a bit on evmar's link.)
- deleted 13y ago[deleted]