3 ms·
Use a proper ciphersuite and stop worrying about downgrade attacks. https://wiki.mozilla.org/Security/Server_Side_TLS https://wiki.mozilla.org/Security/Server_S
by jvehent 11y ago
Use a proper ciphersuite and stop worrying about downgrade attacks. https://wiki.mozilla.org/Security/Server_Side_TLS https://wiki.mozilla.org/Security/Server_Side_TLS
- 0x0 11y agoLooks like it's not enough just to set a proper ciphersuite, it's also important to reconfigure the dhparams (which apparently isn't even possible in most common apache versions). Interestingly, Dovecot seems to have had the foresight to automatically regenerate dhparams weekly by default.
- zobzu 11y agoYou mean like https://wiki.mozilla.org/Security/Server_Side_TLS#DHE_handshake_and_dhparam https://wiki.mozilla.org/Security/Server_Side_TLS#DHE_handsh... ?
- nerdy 11y agoFrom your link: "Before Apache 2.4.7, the DH parameter is always set to 1024 bits and is not user configurable. This has been fixed in mod_ssl 2.4.7 that Red Hat has backported into their RHEL 6 Apache 2.2 distribution with httpd-2.2.15-32.el6. Future versions of Apache will automatically select a better value for the DH parameter." So I suppose he does mean like that.
- elchief 11y ago"The recommendations in this guide provide configurations that are not impacted by this."