4 ms·
Agreed. You can probably drop SSL connections in favour of TLS only if you do this, too. I've done this on my work and personal sites and everything works fine
by tombrossman 12y ago
Agreed. You can probably drop SSL connections in favour of TLS only if you do this, too. I've done this on my work and personal sites and everything works fine for modern browsers.
For example, the config for your Nginx server block can go like this, with no need to support SSL at all.
> ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
I realise this excludes some traffic and I'm okay with it.
- markuskobler 12y agoI have taken exactly the same stance which has the added benefit you can also drop the vulnerable RC4 cyphers. https://wiki.mozilla.org/Security/Server_Side_TLS#RC4_weaknesses https://wiki.mozilla.org/Security/Server_Side_TLS#RC4_weakne...
- yuhong 12y agoYep, if you are requiring SNI, SSLv3 might as well be disabled as SNI will never work with it.