Configuring Older Cipher Suite Support for Servers - Mozilla TLS Config

gchiu · May 30, 2017, 7:54pm

I’ve just in the last 2 days installed https using letsencrypt following the recipe at meta.discourse.org and it works fine for browsers, and I get an A+ rating on ssllabs.

But I have a client with support only for ancient ciphers.

So, how can I enable TLS_DHE_RSA_WITH_AES_256_CBC_SHA which is actually enabled for TLS 1.0 for this site https://community.letsencrypt.org/ as per the SSLLABS report

schoen · May 30, 2017, 8:40pm

Hi @gchiu,

I would suggest using

https://mozilla.github.io/server-side-tls/ssl-config-generator/

You can then find the corresponding configuration lines in your web server configuration files and change them to those that the Mozilla generator suggested to you. In particular, if you choose “Old” instead of “Intermediate”, it will generate a configuration that will work with older clients. (The configuration that you have now is probably your web server’s default for HTTPS; unless I misread something in that recipe, I don’t believe that the recipe actually changed the defaults when enabling HTTPS.)

gchiu · May 31, 2017, 2:07am

What values are you using on this site for

github.com

discourse/discourse_docker/blob/master/templates/web.ssl.template.yml#L22


       return 301 https://$$ENV_DISCOURSE_HOSTNAME$request_uri;
     }
     server {
- replace:
   hook: ssl
   filename: "/etc/nginx/conf.d/discourse.conf"
   from: /listen 80;\s+gzip on;/m
   to: |
     listen 443 ssl http2;
     ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
     ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA;
     ssl_prefer_server_ciphers on;
     ssl_ecdh_curve secp384r1:prime256v1;


     ssl_certificate /shared/ssl/ssl.crt;
     ssl_certificate_key /shared/ssl/ssl.key;


     ssl_session_tickets off;
     ssl_session_timeout 1d;
     ssl_session_cache shared:SSL:1m;

I’m hoping that if I have the same on my discourse site I should then be okay.

schoen · May 31, 2017, 2:25am

I think this site is using to the default Discourse HTTPS configuration, but I’m not sure of that (maybe @jsha knows). The Mozilla configuration generator is likely to be a source of good advice, though: they’ve carefully researched exactly what client versions you’ll achieve compatibility with by taking their recommendations.

gchiu · May 31, 2017, 3:32am

I also used the defaults for my discourse site but I only have 2 cipher suites for TLS 1.0 and your site has 4 so was wondering if the setting in the web.ssl.template.yml file were different to account for that.

jsha · May 31, 2017, 5:54pm

We don’t directly manage the TLS config for this Discourse instance. We use Discourse’s hosted service.

system · June 30, 2017, 5:54pm

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.