Forum Discussion
Bciesz_171056
Cirrus
CirrusSSL Cipher tweaking
Hi,
To be honest i do not completely understand how the cipher string is constructed, but I normally use this one, that used to give me grade A on ssllabs:
!LOW:!SSLv2:!SSLv3:!MD5:!RC4+SHA:!EXPO...
crengifo_232216
Nimbostratus
NimbostratusIf upgrading is not an option, I think you should change the cipher on your client profile. You could use this one:
'DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256'
Keep in mind, assuming that your are using SSL offloading on the LB, ssllabs checks the connection to the load balancer (not to the real server.) So, if the server doesn't support AEAD, you can relax the ciphers on the server profile.
