# SSL default changes? **URL:** \ **Category:** NGINX\ **Created:** [March 11, 2013, 5:49am UTC](https://www.ruby-forum.com/t/ssl-default-changes/227308 "2013-03-11T05:49:11Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [March 11, 2013, 5:49am UTC](https://www.ruby-forum.com/t/ssl-default-changes/227308/1 "2013-03-11T05:49:11Z")
It looks like these changes from default are required for SSL session resumption and to mitigate the BEAST SSL vulnerability: ssl\_session\_cache shared:SSL:10m; ssl\_ciphers RC4:HIGH:!aNULL:!MD5; ssl\_prefer\_server\_ciphers on; Should the defaults be changed to these? - Grant ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [March 11, 2013, 11:53am UTC](https://www.ruby-forum.com/t/ssl-default-changes/227308/2 "2013-03-11T11:53:50Z")
Hello! On Sun, Mar 10, 2013 at 09:48:47PM -0700, Grant wrote: > It looks like these changes from default are required for SSL session > resumption and to mitigate the BEAST SSL vulnerability: > > ssl\_session\_cache shared:SSL:10m; > ssl\_ciphers RC4:HIGH:!aNULL:!MD5; > ssl\_prefer\_server\_ciphers on; > > Should the defaults be changed to these? The BEAST attack could be mitigated by various means, including switching to TLS 1.1/1.2 (you probably do not want to due to compatibility reasons) and/or fixing it on a client side (which is considered to be right solution and already implemented by all modern browsers). Use of the RC4 cipher is more a workaround than a permanent solution, and hence there are no plans to make it the default. – Maxim D. > **[nginx: donation](http://nginx.org/en/donation.html)** ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [March 11, 2013, 8:38pm UTC](https://www.ruby-forum.com/t/ssl-default-changes/227308/3 "2013-03-11T20:38:33Z")
> switching to TLS 1.1/1.2 (you probably do not want to due to > compatibility reasons) and/or fixing it on a client side (which is > considered to be right solution and already implemented by all > modern browsers). > > Use of the RC4 cipher is more a workaround than a permanent > solution, and hence there are no plans to make it the default. OK, why not enable SSL session resumption by default? ssl\_session\_cache shared:SSL:10m; - Grant ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [March 12, 2013, 10:49am UTC](https://www.ruby-forum.com/t/ssl-default-changes/227308/4 "2013-03-12T10:49:00Z")
Hello! On Mon, Mar 11, 2013 at 12:37:37PM -0700, Grant wrote: > > switching to TLS 1.1/1.2 (you probably do not want to due to > > compatibility reasons) and/or fixing it on a client side (which is > > considered to be right solution and already implemented by all > > modern browsers). > > > > Use of the RC4 cipher is more a workaround than a permanent > > solution, and hence there are no plans to make it the default. > > OK, why not enable SSL session resumption by default? > > ssl\_session\_cache shared:SSL:10m; E.g. because it won’t work on some platforms. – Maxim D. > **[nginx: donation](http://nginx.org/en/donation.html)** ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [March 13, 2013, 12:01am UTC](https://www.ruby-forum.com/t/ssl-default-changes/227308/5 "2013-03-13T00:01:29Z")
Hello! On Tue, Mar 12, 2013 at 11:58:51AM -0700, Grant wrote: > > > OK, why not enable SSL session resumption by default? > > > > > > ssl\_session\_cache shared:SSL:10m; > > > > E.g. because it won’t work on some platforms. > > I’m sorry to bother about this, but do you mean it won’t wok on some > servers or in some browsers? If you mean browsers, will it prevent > SSL from working at all in those browsers or would a browser error > appear? It won’t work on some server platforms (e.g. on modern win32, see [nginx for Windows](http://nginx.org/en/docs/windows.html)). – Maxim D. > **[nginx: donation](http://nginx.org/en/donation.html)** ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [March 12, 2013, 7:59pm UTC](https://www.ruby-forum.com/t/ssl-default-changes/227308/6 "2013-03-12T19:59:29Z")
> > OK, why not enable SSL session resumption by default? > > > > ssl\_session\_cache shared:SSL:10m; > > E.g. because it won’t work on some platforms. I’m sorry to bother about this, but do you mean it won’t wok on some servers or in some browsers? If you mean browsers, will it prevent SSL from working at all in those browsers or would a browser error appear? - Grant