# "nginx does not suck at ssl"

**URL:** <https://www.ruby-forum.com/t/nginx-does-not-suck-at-ssl/227287>\
**Category:** NGINX\
**Created:** [March 10, 2013, 6:55am UTC](https://www.ruby-forum.com/t/nginx-does-not-suck-at-ssl/227287 "2013-03-10T06:55:32Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [March 10, 2013, 6:55am UTC](https://www.ruby-forum.com/t/nginx-does-not-suck-at-ssl/227287/1 "2013-03-10T06:55:32Z")

</div>

After reading “nginx does not suck at ssl”:

[http://matt.io/entry/ur](http://matt.io/entry/ur)

I’m using:

ssl\_ciphers  
ALL:!aNULL:!ADH:!eNULL:!MEDIUM:!LOW:!EXP:!kEDH:RC4+RSA:+HIGH;

Is this a good choice?

- Grant

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [March 10, 2013, 11:03am UTC](https://www.ruby-forum.com/t/nginx-does-not-suck-at-ssl/227287/2 "2013-03-10T11:03:12Z")

</div>

one quote from that post i can confirm:

> nobody has any idea how SSL performance works

esp. when it comes to CIPER1 vs CIPHER, compared  
oin terms of speed and security.

what i can suggest to test if your ssl-implementation is stil  
secure from a cipher-pov is

> **[SSL Server Test (Powered by Qualys SSL Labs)](https://www.ssllabs.com/ssltest/)**
>
> A comprehensive free SSL test for your public web servers.

## Grant Wrote:

> - Grant
> 
> * * *
> 
> nginx mailing list  
> [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
> [mailman.nginx.org archive](http://mailman.nginx.org/mailman/listinfo/nginx)

Posted at Nginx Forum:  
[http://forum.nginx.org/read.php?2,237175,237179#msg-237179](http://forum.nginx.org/read.php?2,237175,237179#msg-237179)

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [March 10, 2013, 10:41pm UTC](https://www.ruby-forum.com/t/nginx-does-not-suck-at-ssl/227287/3 "2013-03-10T22:41:57Z")

</div>

> one quote from that post i can confirm:
> 
> > nobody has any idea how SSL performance works
> 
> esp. when it comes to CIPER1 vs CIPHER, compared  
> oin terms of speed and security.
> 
> what i can suggest to test if your ssl-implementation is stil  
> secure from a cipher-pov is  
> [SSL Server Test (Powered by Qualys SSL Labs)](https://www.ssllabs.com/ssltest/)

All things considered, do you think it’s best to leave ssl\_ciphers  
default?

- Grant

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [March 11, 2013, 9:42am UTC](https://www.ruby-forum.com/t/nginx-does-not-suck-at-ssl/227287/4 "2013-03-11T09:42:16Z")

</div>

On Sat, 9 Mar 2013 21:55:13 -0800, Grant [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> After reading “nginx does not suck at ssl”:
> 
> [http://matt.io/entry/ur](http://matt.io/entry/ur)
> 
> I’m using:
> 
> ssl\_ciphers  
> ALL:!aNULL:!ADH:!eNULL:!MEDIUM:!LOW:!EXP:!kEDH:RC4+RSA:+HIGH;

Some of us use the following to mitigate BEAST attacks:  
ssl\_ciphers  
ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!aNULL:!MD5:!EDH;

r.

M.

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [March 11, 2013, 8:45pm UTC](https://www.ruby-forum.com/t/nginx-does-not-suck-at-ssl/227287/5 "2013-03-11T20:45:33Z")

</div>

> ssl\_ciphers ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!aNULL:!MD5:!EDH;  
> Thanks Mark, this is supposed to mitigate BEAST as well and it’s only  
> slightly different than the default:

ssl\_ciphers RC4:HIGH:!aNULL:!MD5;  
ssl\_prefer\_server\_ciphers on;

Here is mex’s link again:

> **[SSL Server Test (Powered by Qualys SSL Labs)](https://www.ssllabs.com/ssltest/)**
>
> A comprehensive free SSL test for your public web servers.

I use the following for better performance:

ssl\_ciphers RC4:HIGH:!aNULL:!MD5:!kEDH;

Reference:  
[http://www.hybridforge.com/blog/nginx-ssl-ciphers-and-pci-compliance](http://www.hybridforge.com/blog/nginx-ssl-ciphers-and-pci-compliance)

- Grant