What compatibility trade-offs do we need to make in order to use a hardened SSL config for Nginx?
- by nathan.f77
I found some hardened SSL settings in github.com/ioerror/duraconf.
Here is the header from the config:
This is an example of a high security, somewhat compatible SSLv3 and TLSv1
enabled HTTPS proxy server. The server only allows modes that provide perfect
forward secrecy; no other modes are offered. Anonymous cipher modes are
disabled. This configuation does not include the HSTS header to ensure that
users do not accidentally connect to an insecure HTTP service after their
first visit.
It only supports strong ciphers in PFS mode:
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
# Only strong ciphers in PFS mode
ssl_ciphers ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA;
ssl_protocols SSLv3 TLSv1;
If we were to use these settings on our website, what does "somewhat compatible" mean? For example, would IE6 still be able to connect?
