# Strong ssl ciphers - browsers

**URL:** <https://www.ruby-forum.com/t/strong-ssl-ciphers-browsers/219597>\
**Category:** NGINX\
**Created:** [May 8, 2012, 3:36pm UTC](https://www.ruby-forum.com/t/strong-ssl-ciphers-browsers/219597 "2012-05-08T15:36:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\
**Post date:** [May 8, 2012, 3:36pm UTC](https://www.ruby-forum.com/t/strong-ssl-ciphers-browsers/219597/1 "2012-05-08T15:36:17Z")

</div>

Hello,

we want to secure our server against beast attack like shown here:  
[http://nginx.org/en/docs/http/configuring\_https\_servers.html](http://nginx.org/en/docs/http/configuring_https_servers.html)  
This is all working.after first tests.  
My Question is: are there some old but still used browsers which would  
be  
excluded from server?  
I just want to know how many people cant do an ssl connection if only  
strong  
ciphers are used.

Thanks,  
Hajo

---

<div class="post-metadata">

**Author:** ![Hajo\_Locke](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/c89c15/32.png) [@Hajo\_Locke](https://www.ruby-forum.com/u/Hajo_Locke)\
**Post date:** [May 9, 2012, 12:16am UTC](https://www.ruby-forum.com/t/strong-ssl-ciphers-browsers/219597/2 "2012-05-09T00:16:28Z")

</div>

Hi Hajo,

BEAST has nothing todo with weak ciphers. Because the workaround is to  
prefer RC4 over AES from the server side, you are not excluding any  
browsers (however, a short check with the oldest supported platform  
isn’t a bad idea either).

I noticed the documentation about the default of the ssl\_ciphers keyword  
isn’t up-to-date: !ADH was replaced with !aNULL in 1.0.5 [2]. Can  
someone update the docs?

[1] [Module ngx\_http\_ssl\_module](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers)

[2] [Re: [PATCH] Disable Anonymous ECDH ciphersuites by default](http://forum.nginx.org/read.php?29,206670,207923)

---

<div class="post-metadata">

**Author:** ![Hajo\_Locke](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/c89c15/32.png) [@Hajo\_Locke](https://www.ruby-forum.com/u/Hajo_Locke)\
**Post date:** [May 9, 2012, 1:23am UTC](https://www.ruby-forum.com/t/strong-ssl-ciphers-browsers/219597/3 "2012-05-09T01:23:43Z")

</div>

On 5/8/12 6:15 PM, Lukas T. wrote:

> Hi Hajo,
> 
> BEAST has nothing todo with weak ciphers. Because the workaround is to prefer  
> RC4 over AES from the server side, you are not excluding any browsers (however, a  
> short check with the oldest supported platform isn’t a bad idea either).

My advice to the OP is that if you want to provide secure connections  
for your users, you will simply not support browsers that _only_ use  
insecure ciphers so I believe this is a non-issue. I wouldn’t purport to  
provide a “secure” connection with an insecure cipher. Let your users  
upgrade to a a 21st century browser. Shame on them if they haven’t.

> I noticed the documentation about the default of the ssl\_ciphers keyword isn’t  
> up-to-date: !ADH was replaced with !aNULL in 1.0.5 [2]. Can someone update the  
> docs?

Somewhat off topic but:

Perhaps it is reasonable to suggest that another change to the defaults  
in light of BEAST.

We use OpenSSL 1.01 and support TLS versions 1.0,1.1, and 1.2 and use  
the following:

```
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers

```

ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4:HIGH:!MD5:!aNULL:!DH:!EDH;  
ssl\_prefer\_server\_ciphers on;

Using latest Opera of IE browsers TLS v1.2 is used along with one of the  
first two ciphers which I believe are not available in SSL v3.0 or TLS  
v1.0. Since TLS v1.2 is not vulnerable to BEAST those connections should  
be “secure”.

In browsers like Firefox and Chrome (and presumably Safari, but I don’t  
know how to tell), TLS v1.0 is used and an RC4 cipher is selected. This  
again provides protection against beast.

While this approach won’t work for users without a recent OpenSSL  
release, the following might work for earlier versions as “more secure”  
default settings:

```
ssl_ciphers RC4:HIGH:!MD5:!aNULL:!DH:!EDH;
ssl_prefer_server_ciphers on;

```

> [1] [Module ngx\_http\_ssl\_module](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers)
> 
> [2] [http://forum.nginx.org/read.php?29,206670,207923](http://forum.nginx.org/read.php?29,206670,207923)

–  
Jim O.

---

<div class="post-metadata">

**Author:** ![Hajo\_Locke](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/c89c15/32.png) [@Hajo\_Locke](https://www.ruby-forum.com/u/Hajo_Locke)\
**Post date:** [May 11, 2012, 6:09pm UTC](https://www.ruby-forum.com/t/strong-ssl-ciphers-browsers/219597/4 "2012-05-11T18:09:54Z")

</div>

On Wed, 2012-05-09 at 00:15 +0200, Lukas T. wrote:

> I noticed the documentation about the default of the ssl\_ciphers  
> keyword isn’t up-to-date: !ADH was replaced with !aNULL in 1.0.5 [2].  
> Can someone update the docs?

> [1] [Module ngx\_http\_ssl\_module](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers)
> 
> [2] [http://forum.nginx.org/read.php?29,206670,207923](http://forum.nginx.org/read.php?29,206670,207923)

We’re working on bringing the documentation up-to-date. I’ll add this  
to the TODO list. Thanks for pointing it out.

Regards,  
Cliff