Changes between Version 3 and Version 4 of Ticket #676, comment 8


Ignore:
Timestamp:
07/26/22 00:50:27 (2 years ago)
Author:
Thomas Spear

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #676, comment 8

    v3 v4  
    99In the default server configuration:
    1010
     11{{{
    1112ssl_protocols TLSv1.2 TLSv1.3;
    1213ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
    1314ssl_conf_command Ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256;
    1415ssl_prefer_server_ciphers on;
     16}}}
    1517
    16 Normally with TLSv1.3 I read that it's best to set ssl_prefer_server_ciphers set to off, because all ciphers are considered secure, and so that devices not supporting AES can choose the Chacha20 cipher instead of being forced to use
     18Normally with TLSv1.3 I read that it's best to set ssl_prefer_server_ciphers to off, because all ciphers are considered secure, and so that devices not supporting AES can choose the Chacha20 cipher instead of being forced to use
    1719AES even without hardware acceleration available to handle it, but here since you are allowing TLSv1.2, you need to prefer server ciphers for security reasons.
    1820