Chrome with Let's Encrypt (Plesk): Old Cyphersuite -
i used plesk extension let's encrypt (https://github.com/plesk/letsencrypt-plesk), chrome shows old cypher suite used. certificate uses:
- tls 1.2
- aes_256_cbc
- hmac-sha1
- ecdhe_rsa
i found out aes_256_cbc seems problem, ui not allow configuration of these parameters.
there configuration file allows this?
found http://letsencrypt.readthedocs.org/en/latest/using.html#configuration-file not seem support these options
thank you
for server-wide can change:
- for nginx,
ssl_ciphers
in/etc/nginx/conf.d/ssl.conf
to:
ssl_ciphers eecdh+aesgcm+aes128:eecdh+aesgcm+aes256:edh+aesgcm+aes128:edh+aesgcm+aes256;
- for apache,
sslciphersuite
in file/etc/apache2/mods-enabled/ssl.conf
:
sslciphersuite eecdh+aesgcm+aes128:eecdh+aesgcm+aes256:edh+aesgcm+aes128:edh+aesgcm+aes256
per individual site can use same strings in additional web server directives apache/nginx:
additionally plesk has all-in-one tool hardening security options in supported services:
plesk sbin pci_compliance_resolver --enable
Comments
Post a Comment