[ https://issues.apache.org/jira/browse/TS-3136?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14594878#comment-14594878 ]
Leif Hedstrom commented on TS-3136: ----------------------------------- Yeah, I'm +1 on doing the "right thing" with DHE for 6.0.0. The reason we made this change was because it theoretically broke backwards compatibility for at least one user (where they got DHE enabled between upgrading from 5.2.0 to 5.3.0). It was arguable though, since they had set their Cipher list to include DHE :). > Change default TLS cipher suites > -------------------------------- > > Key: TS-3136 > URL: https://issues.apache.org/jira/browse/TS-3136 > Project: Traffic Server > Issue Type: Improvement > Components: Security, SSL > Reporter: Leif Hedstrom > Assignee: Susan Hinrichs > Labels: compatibility > Fix For: 6.0.0 > > > In TS-3135 [~i.galic] suggested: > {quote} > also, recommendations for a safer ciphersuite: > SSLCipherSuite > ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4 > > from https://cipherli.st/ > {quote} > [~jacksontj] had responded with: > {quote} > [~i.galic] That cipher quite is geared towards security, but doesn't support > quite a few older clients. I'd recommend we use the suite from mozilla > (https://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_Server_Configurations) > which is a good mix of security and compatibility: > {code} > ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA > {code} > {quote} -- This message was sent by Atlassian JIRA (v6.3.4#6332)