Re: [users@httpd] SSLCipherSuite DEFAULT

2021-04-21 Thread Jim Albert
On 4/21/2021 3:56 PM, @lbutlr wrote: On 20 Apr 2021, at 13:20, Jim Albert wrote: On 4/20/2021 2:56 PM, @lbutlr wrote: Right, and I am running the current version of OpenSSL which, for example, doesn't support SSLv3 or TLSv1.1. I'd be surprised if that were true. If you run 'openssl ciphers -

Re: [users@httpd] SSLCipherSuite DEFAULT

2021-04-21 Thread @lbutlr
On 20 Apr 2021, at 13:20, Jim Albert wrote: > On 4/20/2021 2:56 PM, @lbutlr wrote: >> Right, and I am running the current version of OpenSSL which, for example, >> doesn't support SSLv3 or TLSv1.1. > > I'd be surprised if that were true. > If you run 'openssl ciphers -v ALL' you see no SSLv3 cip

Re: [users@httpd] SSLCipherSuite DEFAULT

2021-04-20 Thread Jim Albert
On 4/20/2021 2:56 PM, @lbutlr wrote: On 20 Apr 2021, at 09:45, Jim Albert wrote: On 4/20/2021 9:48 AM, @lbutlr wrote: If I define SSLCipherSuite DEFAULT will apache show the ciphers that are defined by openSSL and will be used? Is this the best way to go, or should I specifically list TLSv1.

Re: [users@httpd] SSLCipherSuite DEFAULT

2021-04-20 Thread @lbutlr
On 20 Apr 2021, at 09:45, Jim Albert wrote: > On 4/20/2021 9:48 AM, @lbutlr wrote: >> If I define SSLCipherSuite DEFAULT will apache show the ciphers that are >> defined by openSSL and will be used? >> >> Is this the best way to go, or should I specifically list TLSv1.2 and TLS1.3? >> >> The co

Re: [users@httpd] SSLCipherSuite DEFAULT

2021-04-20 Thread Daniel Ferradal
Have you tried the mozzilla ssl generator, it generally is quite good: For intermediate Security allowing TLSv1.2 for example: https://ssl-config.mozilla.org/#server=apache&version=2.4.41&config=intermediate&openssl=1.1.1d&guideline=5.6 El mar, 20 abr 2021 a las 17:46, Jim Albert () escribió: > >

Re: [users@httpd] SSLCipherSuite DEFAULT

2021-04-20 Thread Jim Albert
On 4/20/2021 9:48 AM, @lbutlr wrote: If I define SSLCipherSuite DEFAULT will apache show the ciphers that are defined by openSSL and will be used? Is this the best way to go, or should I specifically list TLSv1.2 and TLS1.3? The complete list of ciphers that openssl supports numbers 60 and sti

[users@httpd] SSLCipherSuite DEFAULT

2021-04-20 Thread @lbutlr
If I define SSLCipherSuite DEFAULT will apache show the ciphers that are defined by openSSL and will be used? Is this the best way to go, or should I specifically list TLSv1.2 and TLS1.3? The complete list of ciphers that openssl supports numbers 60 and still includes some 14 TLSv1 ciphers like