2

I have an SSL wildcard certificate installed on a number of servers, in Firefox the padlock is broken citing a issue with encryption.

Broken Encryption (TLS_RSA_WITH_RC4_128_SHA, 128 bit keys, TLS 1.0)

All other browsers have no issue with the certificate.

This is my Apache config:

SSLProtocol -ALL -SSLv3 -SSLv2 +TLSv1
SSLCipherSuite RC4:HIGH:!ADH:!DH:!AES:!EXPORT:!SSLv2:!3DES

I can't use TLS 1.1 as centos doesn't support it.

The cert is actually 256bits, so I think I need to alter the cipher suite to force a 256bits cipher?

5

You shouldn't use RC4 in any cipher suite, as this cryptographic protocol is considered broken and has been prohibited by the IETF.

Thus the warning from firefox on the use of a RC4-based cipher suite.

You should update your SSLCipherSuite to something such as

SSLCipherSuite HIGH:!RC4:!ADH:!DH:!AES:!EXPORT:!SSLv2:!3DES

Even better would be to take one of the SSLCipherSuite example from this list, depending on what your server actually supports (I guess the intermediate one, but I could be wrong).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.