Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Received-SPF: pass (nike.apache.org: domain of daniel.theodoro@gmail.com
 designates 209.85.216.171 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <507749E5-104C-49B0-A06C-EA014568CB32@kreme.com>
References: <507749E5-104C-49B0-A06C-EA014568CB32@kreme.com>
Date: Wed, 4 Dec 2013 14:38:44 -0200
Message-ID: 
 <CAE9kxh7-Ch-G1XPWRpXxwZ7qUq=x++Zh2Lp6TiMN_cpmXmaarw@mail.gmail.com>
From: Theodoro <daniel.theodoro@gmail.com>
To: users@httpd.apache.org
Content-Type: multipart/alternative; boundary=001a11c30948ea884c04ecb80baa
Subject: Re: [users@httpd] Checking SSLCiphersuite?

--001a11c30948ea884c04ecb80baa
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable

Hi,

Try run this command nmap --script ssl-cert,ssl-enum-ciphers 1.1.1.1 -p 443


On Wed, Dec 4, 2013 at 1:23 PM, LuKreme <kremels@kreme.com> wrote:

> How do I checks what ciphers are available to the https compiled binary,
> and how do I check with of those are active in the configuration?
>
> Is there any technical reason that ECDHE-RSA-AES128-SHA256 cannot be used
> on a server with a self-signed cert (there's no e-commerce or any financi=
al
> data of any sort on the server).
>
> If an existing server wants to switch so that all traffic is encrypted
> using DH if possible (interested in implementing Perfect Forward Secrecy)
> are there any "Gotcha's" lurking in the bushes?
>
> If you enable ECDHE-RSA-AES128-SHA256, should you disable EDH?
>
> To be accessible for most people (including some Windows XP users), what
> else do I need to enable in the cipher suite? RC4? RC4-SHA? TLSv1? AES?
>
> Which ones do I need to avoid?
>
> --
> It's like looking for the farmer's daughter in a haystack, and finding
> the needle.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>


--=20
Daniel Theodoro
Cel: 11 9-9399-3364
http://www.linkedin.com/in/danieltheodoro

=95 RHCE - Red Hat Certified Engineer
=95 LPIC-3 - Senior Level Linux Certification
=95 Novell Certified Linux Administrator - Suse 11
=95 Novell Data Center Technical Specialist - Suse 11
=95 OCA - Oracle Enterprise Linux Administrator Certified Associate
expertise :
EX436 - Red Hat Enterprise Clustering and Storage Management,

--001a11c30948ea884c04ecb80baa
Content-Type: text/html; charset=windows-1252
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi,=A0<div><br></div><div>Try run this command=A0<span sty=
le=3D"background-color:rgb(249,249,249);color:rgb(0,0,0);font-family:monosp=
ace,Courier;font-size:13px;line-height:1.3em">nmap --script ssl-cert,ssl-en=
um-ciphers 1.1.1.1 -p 443</span></div>
</div><div class=3D"gmail_extra"><br><br><div class=3D"gmail_quote">On Wed,=
 Dec 4, 2013 at 1:23 PM, LuKreme <span dir=3D"ltr">&lt;<a href=3D"mailto:kr=
emels@kreme.com" target=3D"_blank">kremels@kreme.com</a>&gt;</span> wrote:<=
br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left=
:1px #ccc solid;padding-left:1ex">
How do I checks what ciphers are available to the https compiled binary, an=
d how do I check with of those are active in the configuration?<br>
<br>
Is there any technical reason that ECDHE-RSA-AES128-SHA256 cannot be used o=
n a server with a self-signed cert (there&#39;s no e-commerce or any financ=
ial data of any sort on the server).<br>
<br>
If an existing server wants to switch so that all traffic is encrypted usin=
g DH if possible (interested in implementing Perfect Forward Secrecy) are t=
here any &quot;Gotcha&#39;s&quot; lurking in the bushes?<br>
<br>
If you enable ECDHE-RSA-AES128-SHA256, should you disable EDH?<br>
<br>
To be accessible for most people (including some Windows XP users), what el=
se do I need to enable in the cipher suite? RC4? RC4-SHA? TLSv1? AES?<br>
<br>
Which ones do I need to avoid?<br>
<span class=3D"HOEnZb"><font color=3D"#888888"><br>
--<br>
It&#39;s like looking for the farmer&#39;s daughter in a haystack, and find=
ing<br>
the needle.<br>
<br>
<br>
---------------------------------------------------------------------<br>
To unsubscribe, e-mail: <a href=3D"mailto:users-unsubscribe@httpd.apache.or=
g">users-unsubscribe@httpd.apache.org</a><br>
For additional commands, e-mail: <a href=3D"mailto:users-help@httpd.apache.=
org">users-help@httpd.apache.org</a><br>
<br>
</font></span></blockquote></div><br><br clear=3D"all"><div><br></div>-- <b=
r>Daniel Theodoro<br>Cel: 11 9-9399-3364<div><a href=3D"http://www.linkedin=
.com/in/danieltheodoro" target=3D"_blank">http://www.linkedin.com/in/daniel=
theodoro</a><br>
<br>=95 RHCE - Red Hat Certified Engineer<br><div><span style=3D"font-famil=
y:Arial,Helvetica,&#39;Nimbus Sans L&#39;,sans-serif;font-size:13px;line-he=
ight:15px"></span>=95=A0<span style=3D"color:rgb(51,51,51);font-family:Helv=
etica,FreeSans,&#39;Liberation Sans&#39;,Helmet,Arial,sans-serif;font-size:=
12.800000190734863px;line-height:17px;background-color:rgb(255,255,255)">LP=
IC-3 - Senior Level Linux Certification</span><br>

=95 Novell Certified Linux Administrator - Suse 11<br>
=95 Novell Data Center Technical Specialist - Suse 11<br>
=95 OCA - Oracle Enterprise Linux Administrator Certified Associate<br>
expertise : <br>
EX436 - Red Hat Enterprise Clustering and Storage Management,
</div></div>
</div>

--001a11c30948ea884c04ecb80baa--