Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am working on trying to make sense of what is required for both PCI DSS compliance as well as FIPS compliance in relation to SSL/TLS cipher suites. I have been reading the guide here and here. However, I have not been able to find anything that states what order or priority I should list the ciphers in. I can see which ones I need to use and disable, but I assume that there is a priority that should be followed for them as well. This is primarily for Windows servers and then later I would look at performing the same to Linux servers running Apache.

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

It depends on the version of Windows/IIS. In 2003 (IIS 6) and earlier, this can't be done. You can only enable/disable ciphers. In Windows 2008 (IIS 7) and later, you can do this through a GPO (if you're domain joined, and I'm guessing this server isn't if it's PCI compliant).

More info here: http://technet.microsoft.com/en-us/library/cc766285(v=ws.10).aspx

share|improve this answer
    
Thank you for the info and the link. Do you know what order I should put them in? –  John Feb 22 '12 at 23:01
    
If PCI doesn't recommend a particular priority (and I believe Shane is correct when he says they don't below), then I wouldn't worry about it. The DSS spec is so airtight as it is, you shouldn't have any problems. –  John Homer Feb 23 '12 at 15:34
add comment

Why would you assume that there's a priority needed?

No compliance standard that I've ever heard of has recommended a specific priority; after all, if a cipher's insecure, it should be turned off instead of just de-prioritized.

That said, preferring RC4 over CBC-constructed ciphers might be wise until TLS 1.1 is widely deployed; see CVE-2011-3389.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.