SSL Ciphers

[marshallford]

SSL Ciphers

[willfarrell]

All of the nginx configs mentioned on the site are already covered here plus a few more. With regards to changing the cipher suite. I'm guessing you're thinking "which is it the most secure?", a better question is, "which is the most secure for my users browser?"
While AES128+EECDH:AES128+EDH would be a secure cipher suite (at this moment in time), it would be very restrictive on who could connect to your site securely. What is currently documented in https://github.com/h5bp/server-configs-nginx/blob/master/h5bp/directive-only/ssl.conf is a good balance between strong ciphers and widest user availability (Firefox 1, Chrome 1, IE 7, Opera 5 and Safari 1). Personally I would remove CAMELLIA from the list which would prevent Java 6u45 from accessing your site but would make you site FIPS 140-2 compliant. If you don't need to support IE8 you can also remove TLS_RSA_WITH_3DES_EDE_CBC_SHA that doesn't support Forward Secrecy.

If you're worried about your TLS cert run a scan on it. I would recommend SSLLABS or GlobalSign which uses SSLLabs, but displays results differently.

[Rowno]

Also see https://wiki.mozilla.org/Security/Server_Side_TLS and https://mozilla.github.io/server-side-tls/ssl-config-generator/

[AD7six]

Closing as I don't see any action to take =).

Also note:

• The existing cipher suite is from mozilla's site
• The ssl config generator is mentioned in the docs

[marshallford]

Alright, thanks. The issue was less of "you need to change something" and more of "hey maintainers, take a look at this if you haven't seen it already".

Thanks for a great project, as I always I appreciate the work.