3 ms·

I agree. Unfortunately, there is currently no way to configure different ciphersuites for different versions of TLS. With issues like BEAST, it would be highly

by jvehent 13y ago

I agree. Unfortunately, there is currently no way to configure different ciphersuites for different versions of TLS. With issues like BEAST, it would be highly beneficial if Apache, Nginx & others would supports ciphers preferences per TLS versions. That still wouldn't help old clients. For them, only one solution: upgrade!

ivanr 13y ago
Yes, that would be nice. I've heard that PolarSSL has per-protocol suite selection. It's really something the underlying SSL library needs to support. With OpenSSL, the best we can do right now is prioritize suites so that SHA2 ones are on top. By doing that, you know that TLS 1.2 capable clients are going to use good suites. The rest will fall back to whatever is below.