Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

The testing tool https://www.ssllabs.com/ssltest/index.html tells me that my server is offering/supporting:

SSL_RSA_WITH_DES_CBC_SHA (0x9) WEAK 56
SSL_DHE_RSA_WITH_DES_CBC_SHA (0x15) DH 1024 bits (p: 128, g: 128, Ys: 128) FS WEAK 56
RC4 Yes NOT DESIRABLE

At least these two weak ciphers. I'd like to support only strong ciphers. I've tried specifying

ssl.cipher-list = "HIGH:MEDIUM:!ADH"

But that has not helped. How do I tell lighthttpd not to use weak ciphers for SSL?

If I can also address "Forward Secrecy (Experimental) No NOT DESIRABLE" at the same time, great.

share|improve this question

2 Answers 2

up vote 3 down vote accepted

Finally, here is the ultimate "secret sauce":

Pass the SSL Labs Test on Lighttpd (Mitigate the CRIME and BEAST attack, Disable SSLv2 and Enable Perfect Forward Secrecy).

Please read the link for concrete configuration directives.

share|improve this answer
1  
Welcome to SuperUser! Could you please add the relevant details from the link to your post? This helps the site avoid "link rot" in the long-term: superuser.com/questions/how-to-answer –  Excellll Aug 16 '13 at 13:34
    
From the above post: ssl.cipher-list = "AES256+EECDH:AES256+EDH:!aNULL:!eNULL" –  jmuc Oct 15 at 7:21

For a general approach/tutorial on how to build the right cipher suite config you might like to have a look here: http://www.skytale.net/blog/archives/22-SSL-cipher-setting.html

However, the author did not seem to pay attention to implementing DHE cipher suites; you will need these DHE ciphers in order to allow Forward Secrecy (FS) for your SSL connection.

For a 'ready-to-take cipher suite config' including DHE please have a look here. Seems that this config has also been tested to work with a few browser and OS setups: https://github.com/pfsense/pfsense/pull/683

PS: please note that the message "Forward Secrecy (Experimental) No NOT DESIRABLE" from SSLlabs seems to show up no matter if FS is working or not with your connection, so for the time being don't bother too much about that message.

share|improve this answer
    
The secret sauce a few links away was: ssl.honor-cipher-order = "enable" ssl.cipher-list = "ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4-SHA:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM‌​" –  arantius Aug 15 '13 at 16:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.