Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Set ssl_prefer_server_ciphers to off #328

Merged
merged 2 commits into from
Feb 24, 2023
Merged

Set ssl_prefer_server_ciphers to off #328

merged 2 commits into from
Feb 24, 2023

Conversation

avj
Copy link
Contributor

@avj avj commented Feb 24, 2023

Per discussion here: #325

@LeoColomb LeoColomb changed the title Set ssl_prefer_server_ciphers to off with explanation Set ssl_prefer_server_ciphers to off Feb 24, 2023
@LeoColomb LeoColomb linked an issue Feb 24, 2023 that may be closed by this pull request
Improve SSL/TLS grade #325
Closed
@LeoColomb LeoColomb merged commit 22abda7 into h5bp:main Feb 24, 2023
@emansom
Copy link

emansom commented Feb 25, 2023 •
edited
Loading

@LeoColomb Can this be reverted? This will introduce downgrade attack potential.

There's an alternative and better way to configure OpenSSL to read the client's intent on using hardware accelerated paths, it needs some system-wide configuration (via NGINX's ssl_conf_command directive) of the OpenSSL library used by NGINX.

I'll dig through my systems today to find the specific configuration tweaks needed.

@quantumpacket
Copy link
Contributor

This comment explains the reasoning for turning it to "off" for modern browsers. mozilla/server-side-tls#260 (comment)

@LeoColomb
Copy link
Member

Thanks for your comments.
@emansom This PR is also the outcome of #325 discussion.
Don't hesitate to continue the discussion there 🙂

LeoColomb added a commit to h5bp/server-configs-apache that referenced this pull request May 27, 2023
@LeoColomb
Set SSLHonorCipherOrder to Off
dc8e0ce 
See:
* h5bp/server-configs-nginx#328
* h5bp/server-configs-nginx#325
* mozilla/server-side-tls#260 (comment)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@LeoColomb LeoColomb LeoColomb approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Improve SSL/TLS grade
4 participants
@avj @emansom @quantumpacket @LeoColomb