Forum Discussion

rabid_gerbil_26's avatar
Sep 30, 2016
Solved

SSL Cipher...Will this give me what I want?

After an audit, it was found that we need to start using a stricter SSL Profile. This is the string we have come up with however there are disagreements on whether this will only allow the listed Ciphers to be used with TLS1.2 and not any other Ciphers.

ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:TLS1_2:!TLS1_1:!TLS1:!SSLv2:!SSLv3:!ADH:!MD5:!RC4:!DES:!NULL:!EXP:!LOW

The listing is prioritized left to right.

I only want TLS1.2 to use the Ciphers below and no other cipher even if TLS1.2 is compatible.

ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256

  • I found what I was looking for. Using the Testsslserver ( http://www.bolet.org/TestSSLServer ) program I was able to test different strings to get the perfect match that we were looking for.

     

1 Reply

  • I found what I was looking for. Using the Testsslserver ( http://www.bolet.org/TestSSLServer ) program I was able to test different strings to get the perfect match that we were looking for.