5 ms·

For someone without the time to compile OpenSSL and nginx/apache, what is a recommended Linux distro with support for TLS 1.2 and PFS? I'm normally a Debian St

For someone without the time to compile OpenSSL and nginx/apache, what is a recommended Linux distro with support for TLS 1.2 and PFS? I'm normally a Debian Stable and CentOS6 guy, but both fall flat here, last I checked.

agwa 13y ago
Debian Stable (Wheezy)'s OpenSSL has everything you need: TLSv1.2, elliptic curve crypto. However, its Apache doesn't support elliptic curve crypto so you'll have to use the slower discrete log Diffie Hellman to get PFS with Apache. I'm not sure about the version of nginx in Wheezy.
- ivanr 13y ago
  If you're stuck with Apache 2.2.x (and thus no support for Elliptic Curve crypto), perhaps you should give TLS Interposer a try: https://netfuture.ch/tools/tls-interposer/ https://netfuture.ch/tools/tls-interposer/ It adds ECDHE support without having to upgrade to Apache 2.4.x.
  - agwa 13y ago
    Wow, that's an extremely cool program. Thanks!
- makomk 13y ago
  The nginx package in Wheezy supports both TLSv1.2 and ECDHE as well as AES-GCM, I'm using them with it at the moment.
pixl97 13y ago
CentOS6 OpenSSL supports TLS1.2 and PFS https://www.ssllabs.com/ssltest/viewClient.html?name=OpenSSL&version=1.0.1e https://www.ssllabs.com/ssltest/viewClient.html?name=OpenSSL... CentOS 6.5 comes with nginx 1.0.15 which by the documentation supports TLS1.2
- agwa 13y ago
  Unfortunately RedHat (and by extension, CentOS) [edit: prior to RHEL/CentOS 6.5] strips elliptic curve crypto out of OpenSSL, so the list of ciphers you linked to is not accurate. For PFS on CentOS you're stuck with the slower discrete log Diffie Hellman. Edited to add: my information is out of date! See ivanr's reply.
  - ivanr 13y ago
    It used to. As far as I know RHEL 6.5 was the first to enable Elliptic Curve cryptography by default. Fedora 18 and later were updated to support it, too. For more details, see here: https://bugzilla.redhat.com/show_bug.cgi?id=319901 https://bugzilla.redhat.com/show_bug.cgi?id=319901

agwa 13y ago

Debian Stable (Wheezy)'s OpenSSL has everything you need: TLSv1.2, elliptic curve crypto. However, its Apache doesn't support elliptic curve crypto so you'll have to use the slower discrete log Diffie Hellman to get PFS with Apache. I'm not sure about the version of nginx in Wheezy.

ivanr 13y ago
If you're stuck with Apache 2.2.x (and thus no support for Elliptic Curve crypto), perhaps you should give TLS Interposer a try: https://netfuture.ch/tools/tls-interposer/ https://netfuture.ch/tools/tls-interposer/ It adds ECDHE support without having to upgrade to Apache 2.4.x.
- agwa 13y ago
  Wow, that's an extremely cool program. Thanks!
makomk 13y ago
The nginx package in Wheezy supports both TLSv1.2 and ECDHE as well as AES-GCM, I'm using them with it at the moment.

pixl97 13y ago

CentOS6 OpenSSL supports TLS1.2 and PFS https://www.ssllabs.com/ssltest/viewClient.html?name=OpenSSL&version=1.0.1e https://www.ssllabs.com/ssltest/viewClient.html?name=OpenSSL... CentOS 6.5 comes with nginx 1.0.15 which by the documentation supports TLS1.2

agwa 13y ago
Unfortunately RedHat (and by extension, CentOS) [edit: prior to RHEL/CentOS 6.5] strips elliptic curve crypto out of OpenSSL, so the list of ciphers you linked to is not accurate. For PFS on CentOS you're stuck with the slower discrete log Diffie Hellman. Edited to add: my information is out of date! See ivanr's reply.
- ivanr 13y ago
  It used to. As far as I know RHEL 6.5 was the first to enable Elliptic Curve cryptography by default. Fedora 18 and later were updated to support it, too. For more details, see here: https://bugzilla.redhat.com/show_bug.cgi?id=319901 https://bugzilla.redhat.com/show_bug.cgi?id=319901