Having run https://www.ssllabs.com/ssltest/index.html on a newly built Domino 8.5.3 server, is it possible to configure for https://community.qualys.com/blogs/securitylabs/2011/10/17/mitigating-the-beast-attack-on-tls
The server initially got a score of "F", but adding SSL_DISABLE_RENEGOTIATE=1 and unchecking the old SSL Ciphers has improved the score to "B".
(I've update the following to the correct settings as per the blog post below)
To clarify the following SSL Ciphers are enabled:
- RC4 encryption with 128-bit key and MD5 MAC
- RC4 encryption with 128-bit key and SHA-1 MAC
The following SSL Ciphers are disabled:
- AES encryption with 128-bit key and SHA-1 MAC (Domino 8+ only)
- AES encryption with 256-bit key and SHA-1 MAC (Domino 8+ only)
- DES encryption with 56-bit key and SHA-1 MAC
- Triple DES encryption with 168-bit key and SHA 1 MAC
- RC4 encryption with 40-bit key and MD5 MAC
- No encryption with MD5 MAC
- No encryption with SHA-1 MAC
SSL v2 is not enabled
No comments:
Post a Comment