I am trying to enable and enforce RC4 cipher on Apache 2.4 and I checked the http://httpd.apache.org/docs/trunk/ssl/ssl_howto.html It says RC4 cipher can be enabled in one of the below two ways:

1. SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:!aNULL:!MD5 
   SSLHonorCipherOrder on


Which one is the better to enable and enforce RC4 cipher?

How do I test the enabled ciphers with openSSL?

  • No one of those will enforce RC4. The second activates all, the first activates all highs. – sebix Jun 23 '15 at 19:04

You want to... enable RC4? Is this for some sort of honeypot or something? You really don't want to use it in normal use, because RC4 is broken.

If you really want to, though, I think the way to enforce the use of RC4 would be just to make the cipher spec RC4 by itself -- that'll enable all cipher combinations that include the use of RC4. You may want to then disable some of the even-more-broken ciphers, like NULL and export-grade ciphers, as well as deprecated unnecessary ones like MD5, with something like RC4:!MD5:!aNULL:!EXPORT.

And may $DEITY have mercy on your soul...

  • MD5 for HMAC isn't broken last I heard, although SHA (meaning SHA1) is better; !EXPORT and !aNULL prevent dangers that would be worse, although good clients won't offer them anyway. – dave_thompson_085 Aug 19 '15 at 10:00
  • @dave_thompson_085 good catch on export/NULL; I've added them to my answer. As for HMAC-MD5, RFC6151 says "it isn't quite broken yes, but don't use it for anything new". Since I don't know of any reasonably popular SSL client implementation that only supports MD5, it seems prudent to get ahead of the curve and just turn 'em off now. – womble Aug 19 '15 at 21:07

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.