[jira] [Comment Edited] (TS-2400) Our default SSL cipher-suite advocates speed over security

["Igor Galić (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/TS-2400?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13873486#comment-13873486 ] 

Igor Galić edited comment on TS-2400 at 1/16/14 3:20 PM:
---------------------------------------------------------

I'd leave it in, and see that we fix the DHE support.

This on the other hand looks like a no-go: RC4-MD5


was (Author: i.galic):
I'd leave it in, and see that we fix the DHE support.

> Our default SSL cipher-suite advocates speed over security
> ----------------------------------------------------------
>
>                 Key: TS-2400
>                 URL: https://issues.apache.org/jira/browse/TS-2400
>             Project: Traffic Server
>          Issue Type: Bug
>          Components: Configuration, SSL
>            Reporter: Igor Galić
>            Assignee: Igor Galić
>             Fix For: 4.2.0
>
>
> Our default cipher-suite advocates speed over security:
> {code}
> RC4-SHA:AES128-SHA:DES-CBC3-SHA:AES256-SHA:ALL:!aNULL:!EXP:!LOW:!MD5:!SSLV2:!NULL
> {code}
> Worse yet, it still has RC4 in there, along with some other bad defaults. RC4 must be eradicated: https://blogs.technet.com/b/srd/archive/2013/11/12/security-advisory-2868725-recommendation-to-disable-rc4.aspx?Redirected=true
> We should by default advocate security, which means, we should advocate Perfect Forward Secrecy, which means we should also advocate OpenSSL >= 1.0.1e 



--
This message was sent by Atlassian JIRA
(v6.1.5#6160)