[ck2]

I guess it is a slow news day but there are better guides out there.

If you are using centos or any redhat related product you will have to build your own openssl to get 1.0.1 with perfect-forward-secrecy (the IUS repository does NOT include EC ciphers either). RedHat decided EC ciphers have patents that are valid (they are not).

The example configuration is missing ocsp stapling.

Their configuration is also including the root certificate in the download for every connection which is unnecessary.

Using RC4 over AES for beast mitigation is no longer considered optimal, if anything RC4 is not 100% trustworthy anymore. Lean on elliptic-curve ciphers with AES over RC4 for modern browsers. As a bonus you get CPU acceleration for AES on most servers and many newer home computers.

[plentz]

Thanks for the heads up ck2. I've updated the config to add ocsp stapling. The certificate really has a extra(unnecessary) root certificate, I will solve this later today.

The RC4 part is based on this article https://community.qualys.com/blogs/securitylabs/2013/08/05/c.... But I will do some more research and update the post.

[ck2]

Ivan has already adjusted his views on RC4 as you can read here:

https://community.qualys.com/blogs/securitylabs/2013/09/17/u...

And the qualys SSL analyzer no longer penalizes for not mitigating Beast, they just warn about it in orange but there is no longer a penalty as of a couple weeks ago.

[plentz]

Thanks again ck2. I will read it today and update the post to mitigate BEAST as well. Better then that, do you have a better setup for chipers?

[ck2]

The best thing I did with ciphers is stop just using everyone's "magic list" without understanding what they are and what they mean.

To start understanding the magic list of ciphers, enter the list into openssl like this and watch what it produces:

  openssl ciphers -V 'RC4'
  openssl ciphers -V 'EECDH+aRSA+RC4 EECDH EDH+aRSA !aNULL !eNULL !LOW'  

(etc. etc.)

take away some of the adds/exclusions in the list and watch what they add/remove. Plug in other people's lists and see what they do.

Then learn what ECDHE vs DHE means (and why DHE is slower)

Then learn about RSA vs DSA keys, EC ciphers etc.

Then play around with this tool that shows you what ciphers different browser support (try it with IE8 vs Firefox vs Chrome, etc) https://cc.dcsec.uni-hannover.de/

Then read about AES hardware acceleration in openssl on most modern processors (not all but many). http://zombe.es/post/4078724716/openssl-cipher-selection

and eventually, a few days later, you'll start to understand what is best :-)

It is always much more than a few lines in a configuration file if you really want to understand.