Subscribe to the RSS feed in case you are interested in updates
PS: In order to know whether this type of publication is useful to some and whether I should spend time on such publications in the future, I would appreciate a heads-up if you find this to be interesting. Thierry
Copied from the post over at G-SEC:
At last. What started as an "I need an overview of best practise in SSL/TLS configuration" type of idea, ended in a 3 month code, reverse engineer and writing effort. I really hope this comes in handy for you and was worth the effort. This is the "Release candidate" version of the paper, should no errors be found it will be the final version.
At last. What started as an "I need an overview of best practise in SSL/TLS configuration" type of idea, ended in a 3 month code, reverse engineer and writing effort. I really hope this comes in handy for you and was worth the effort. This is the "Release candidate" version of the paper, should no errors be found it will be the final version.
This paper aims at answering the following questions :
- What SSL/TLS configuration is state of the art and considered secure (enough) for the next years?
- What SSL/TLS ciphers do modern browsers support ?
- What SSL/TLS settings do server and common SSL providers support ?
- What are the cipher suites offering most compatibility and security ?
- Should we really disable SSLv2 ? What about legacy browsers ?
- How long does RSA still stand a chance ?
- What are the recommended hashes,ciphers for the next years to come
The paper includes two tools :
Without further ado here is the complete package
PS: In order to know whether this type of publication is useful to some and whether I should spend time on such publications in the future, I would appreciate a heads-up if you find this to be interesting. Thierry
.png)
