ngx_http_ssl_module and ssl_ciphers (use of RC4)

[Jeffrey Walton]

From ​http://nginx.org/en/docs/http/ngx_http_ssl_module.html:

Specifies the enabled ciphers. The ciphers are specified in the format understood
by the OpenSSL library, for example:

    ssl_ciphers ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;

The full list can be viewed using the “openssl ciphers” command.

RC4 is not really suitable for use in SSL/TLS. From AlFardan, Bernstein (et al), "On the Security of RC4 in TLS and WPA":

    ... While the RC4 algorithm is known to have a
    variety of cryptographic weaknesses (see [26]
    for an excellent survey), it has not been previously
    explored how these weaknesses can be exploited
    in the context of TLS. Here we show that new and
    recently discovered biases in the RC4 keystream
    do create serious vulnerabilities in TLS when using
    RC4 as its encryption algorithm.

[Maxim Dounin]

Documentation doesn't try to suggest any settings, it just shows how to use the directive.

[Jeffrey Walton]

Documentation doesn't try to suggest any settings

That's not how it works in real life.