[Ach] SSL for limited user groups
hanno at hboeck.de
Thu Jan 1 14:11:51 CET 2015
On Thu, 01 Jan 2015 13:26:15 +0100
"Robert M. Albrecht" <lists at romal.org> wrote:
> SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
This doesn't look like a very reasonable config for your setting.
If you have a closed user group and can rely on only high security
settings you likely want to limit your config to ciphers with forward
secrecy and AES-GCM. (and if you're running libressl or some openssl
preview/beta you can add chacha20)
It's pretty much consensus that everything using CBC should be
considered dangerous and we should strive for deprecating it. That
means all Camellia ciphers and all non-gcm-aes-modes.
mail/jabber: hanno at hboeck.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Size: 819 bytes
Desc: OpenPGP digital signature
More information about the Ach