My Community Dashboard

  • James Joseph
    James Joseph started a new discussion, SSL3 Ciphers

    SSL3 Ciphers

    I'm trying to get ssllabs to allow me to get higher then a C rating but the only way to do so is disable all SSL3 ciphers completely. While on our server it's fine to only have TLS 1.2 however on some clients that's a problem as blackberry doesn't support TLS 1.2 only TLS 1.0 or 1.1 so we can't use activesync.

    I've looked into disabling weak ciphers but this doesn't seem to work at least not the ones I've tried. Has anyone got any good experience with ciphers and what would make ssllabs know I've disabled ssl3 but still have TLS 1.0, 1.1 & 1.2

    current config on ssl.conf

    SSLProtocol -ALL +TLSv1 +TLSv1.1 +TLSv1.2
    SSLCipherSuite "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS"

    However only this will get me to A+ with enabling HSTS

    SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS:-LOW:-SSLv2:-SSLv3:-EXP:!kEDH