4 ms·
And so begins years of copy/paste of cipher lists without knowing what they mean or do. Your cipher list should be far more paired down than their list. And u
by ck2 13y ago
And so begins years of copy/paste of cipher lists without knowing what they mean or do.
Your cipher list should be far more paired down than their list.
And unless you need IE6 support for SSL, you can disable SSLv3 (v2 should always be disabled)
- Sambdala 13y agoIs/Are there resource(s) you'd point someone to if they didn't fully understand the topic but would like to become competent?
- cmhamill 13y agoThe "OpenSSL Cookbook" book you get when you sign up for notifications about the book at this site[1] is very good. Written by the guy behind SSLLabs, if I recall correctly. [1] https://www.feistyduck.com/books/bulletproof-ssl-tls-and-pki/ https://www.feistyduck.com/books/bulletproof-ssl-tls-and-pki...
- jvehent 13y agoYes, the goal is to provide a ciphersuite that can be copied directly. But instead of stopping after the first paragraph, we explain why we think this ciphersuite is best. The guideline is not just a ciphersuite, it's a study of the state-of-the-art of SSL/TLS. At the end of the day, it's not realistic to imagine that everyone will spend days researching this to come up with a proper ciphersuite. There is a strong need for guidance. You are correct about SSLv3: it is up to each organization to stop supporting it. But do know that it is still widely used, if not in browser, in client libraries. I wouldn't turn it off on a corporation site if I were you.