Commit 24fa6c9c authored by Kaspar Brand's avatar Kaspar Brand
Browse files

Change the SSLCipherSuite default to a shorter, whitelist 

oriented definition, and add an example for a speed-optimized
configuration (commented out by default).

In the SSL How-To, streamline the SSLCipherSuite examples where
applicable (explicitly banning EXP and NULL is not needed when
only HIGH is specified).


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1203752 13f79535-47bb-0310-9956-ffa450edef68
parent e7464e95

docs/conf/extra/httpd-ssl.conf.in

+13 −6
Changes for docs/conf/extra/httpd-ssl.conf.in: 13 added lines, 6 removed lines.
Original line number Diff line number Diff line
@@ -48,12 +48,19 @@ Listen @@SSLPort@@ 
#   SSL Cipher Suite:

#   List the ciphers that the client is permitted to negotiate.

#   See the mod_ssl documentation for a complete list.

SSLCipherSuite RC4-SHA:AES128-SHA:ALL:!aNULL:!EXP:!LOW:!MD5:!SSLV2:!NULL



#   SSL Cipher Honor Order:

#   On a busy HTTPS server you may want to enable this directive

#   to force clients to use one of the faster ciphers like RC4-SHA

#   or AES128-SHA in the order defined by SSLCipherSuite.

SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5



#   Speed-optimized SSL Cipher configuration:

#   If speed is your main concern (on busy HTTPS servers e.g.),

#   you might want to force clients to specific, performance

#   optimized ciphers. In this case, prepend those ciphers

#   to the SSLCipherSuite list, and enable SSLHonorCipherOrder.

#   Caveat: by giving precedence to RC4-SHA and AES128-SHA

#   (as in the example below), most connections will no longer

#   have perfect forward secrecy - if the server's key is

#   compromised, captures of past or future traffic must be

#   considered compromised, too.

#SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:MEDIUM:!aNULL:!MD5

#SSLHonorCipherOrder on 



#   Pass Phrase Dialog:

docs/manual/ssl/ssl_howto.xml

+6 −10
Changes for docs/manual/ssl/ssl_howto.xml: 6 added lines, 10 removed lines.
Original line number Diff line number Diff line
@@ -66,21 +66,17 @@ requires a strong cipher for access to a particular URL?</a></li> 
only?</title>

    <p>The following enables only the strongest ciphers:</p>

    <example><title>httpd.conf</title>

      SSLProtocol all -SSLv2<br />

      SSLCipherSuite HIGH:!aNULL:!EXP:!MD5:!NULL<br />

      SSLCipherSuite HIGH:!aNULL:!MD5<br />

    </example>



    <p>While with the following configuration you enable two ciphers

    which are resonably secure, and fast:</p>

    <p>While with the following configuration you specify a preference

    for specific speed-optimized ciphers (which will be selected by

    mod_ssl, provided that they are supported by the client):</p>



    <example><title>httpd.conf</title>

      SSLProtocol all -SSLv2<br />

      SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:!aNULL:!EXP:!MD5:!NULL<br />

      SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:!aNULL:!MD5<br />

      SSLHonorCipherOrder on

    </example>



    <p>This strongly reflects the default value of <directive module="mod_ssl"

    >SSLCipherSuite</directive> and is the recommanded way to configure it.</p>

</section>



<section id="strongurl">
@@ -101,7 +97,7 @@ URL?</title> 
      &lt;Location /strong/area&gt;<br />

      # but https://hostname/strong/area/ and below<br />

      # requires strong ciphers<br />

      SSLCipherSuite HIGH:!aNULL:!EXP:!MD5:!NULL<br />

      SSLCipherSuite HIGH:!aNULL:!MD5<br />

      &lt;/Location&gt;

    </example>

</section>