Correct me if I'm wrong but BEAST is because of CBC in TLSv1.0, right? So to eliminate the threat of BEAST all CBC cipher suites which are SSLv3 or lower have to be disabled, right?
Lets jump into the real world example. See the Qualys SSL Test for my test domain. You'll see that I have disabled SSLv3 (and lower of course) with protocols. To maintain some old clients which do not support TLSv1.1 and at the same time maintain Perfect Forward Secrecy for those clients I have to use some CBC cipher suites that came with SSLv3 or TLSv1.0.
Here are some samples of clients I have to maintain (with link to Qualys SSL Client Info site).
Here is my OpenSSL 1.0.1e cipher suite configuration:
Does anybody see a solution to fix BEAST and maintain Client/PFS? I only see max. TLSv1.0 and CBC only cipher suites on the client side.
To catch up with Michael Hampton: Yes, RC4 is not a solution. I forgot to mention that.