4 ms·
We (https://commando.io https://commando.io) use: ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA
by nodesocket 13y ago
We (https://commando.io https://commando.io) use:
ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";
Which results in perfect forward secrecy and an A+ rating in SSL Labs.
- poobrains 13y agoIs that the same as Ivan Ristic's recommendation at https://community.qualys.com/blogs/securitylabs/2013/08/05/configuring-apache-nginx-and-openssl-for-forward-secrecy https://community.qualys.com/blogs/securitylabs/2013/08/05/c...
- edwintorok 12y agoWhich means you shouldn't trust that A+ single metric without actually looking at the browser list or testing it yourself. I just opened your site on Debian unstable with latest Iceweasel/Firefox 24.5.0, and I get connected via RC4. Arguably thats also NSS's fault for implementing TLS1.2 so late, but still... My site only gets an "A" rating, but Firefox actually connects using ECDHE-RSA-AES256-SHA. I use this cipherlist HIGH:!SSLv2:!aNULL:!3DES Which one is more secure?
- vilda 12y agoThe difference between A and A+ is in Strict-Transport-Security HTTP header.