2

The testing tool https://www.ssllabs.com/ssltest/index.html tells me that my server is offering/supporting:

SSL_RSA_WITH_DES_CBC_SHA (0x9) WEAK 56
SSL_DHE_RSA_WITH_DES_CBC_SHA (0x15) DH 1024 bits (p: 128, g: 128, Ys: 128) FS WEAK 56
RC4 Yes NOT DESIRABLE

At least these two weak ciphers. I'd like to support only strong ciphers. I've tried specifying

ssl.cipher-list = "HIGH:MEDIUM:!ADH"

But that has not helped. How do I tell lighthttpd not to use weak ciphers for SSL?

If I can also address "Forward Secrecy (Experimental) No NOT DESIRABLE" at the same time, great.

Improve this question

2 Answers 2

Reset to default
4

Finally, here is the ultimate "secret sauce":

Pass the SSL Labs Test on Lighttpd (Mitigate the CRIME and BEAST attack, Disable SSLv2 and Enable Perfect Forward Secrecy).

Please read the link for concrete configuration directives.

Improve this answer
3
  • 1
    Welcome to SuperUser! Could you please add the relevant details from the link to your post? This helps the site avoid "link rot" in the long-term: superuser.com/questions/how-to-answer
    – Excellll
    Aug 16, 2013 at 13:34
  • From the above post: ssl.cipher-list = "AES256+EECDH:AES256+EDH:!aNULL:!eNULL"
    – jmuc
    Oct 15, 2014 at 7:21
  • not anymore, that only gets you an A. the site itself only gets an A now
    – cantsay
    Dec 28, 2019 at 19:08
3

For a general approach/tutorial on how to build the right cipher suite config you might like to have a look here: http://www.skytale.net/blog/archives/22-SSL-cipher-setting.html

However, the author did not seem to pay attention to implementing DHE cipher suites; you will need these DHE ciphers in order to allow Forward Secrecy (FS) for your SSL connection.

For a 'ready-to-take cipher suite config' including DHE please have a look here. Seems that this config has also been tested to work with a few browser and OS setups: https://github.com/pfsense/pfsense/pull/683

PS: please note that the message "Forward Secrecy (Experimental) No NOT DESIRABLE" from SSLlabs seems to show up no matter if FS is working or not with your connection, so for the time being don't bother too much about that message.

Improve this answer
1
  • The secret sauce a few links away was: ssl.honor-cipher-order = "enable" ssl.cipher-list = "ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4-SHA:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM"
    – arantius
    Aug 15, 2013 at 16:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .