Latest SSL configuration

[ericovk]

Hi,
I am a bit lost in what the proper SSL configuration should be?

I found this help topic: http://help.directadmin.com/item.php?id=571
The settings mentioned in this topic, is a lot different than my current SSLCipherSuite setting.

DA help:

SSLProtocol All -SSLv2 -SSLv3
SSLHonorCipherOrder On
SSLCipherSuite HIGH:!aNULL:!MD5

One of my server has this configuration:

# Disable SSLv2/3
SSLProtocol All -SSLv2 -SSLv3
SSLHonorCipherOrder On
# https://mozilla.github.io/server-side-tls/ssl-config-generator/ intermediate configuration.
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA

I can't tell the difference. What is the right config to go for?

 

[zEitEr]

Hello,

The guide http://help.directadmin.com/item.php?id=571 might be a little bit outdated.
You can use the suggested link https://mozilla.github.io/server-side-tls/ssl-config-generator/ to create a list ciphers to use.

 

[ericovk]

Great, thanks Alex for your support!