Skip to content

Instantly share code, notes, and snippets.

@starchy

starchy/apache2.2-ssl.conf

Last active August 29, 2015 14:21
Show Gist options
  • Save starchy/188f0f16ff75445d5211 to your computer and use it in GitHub Desktop.
Save starchy/188f0f16ff75445d5211 to your computer and use it in GitHub Desktop.
Download ZIP
Logjam-avoidant PFS SSL config for Apache 2.2
Raw
apache2.2-ssl.conf
Best security, but leaves older clients vulnerable to "state-level adversaries":
SSLEngine on
SSLProtocol All -SSLv2 -SSLv3
SSLHonorCipherOrder On
SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH EDH+aRSA !RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS
Header add Strict-Transport-Security "max-age=31536000"
Best config, but no IE8 support:
SSLEngine on
SSLProtocol All -SSLv2 -SSLv3
SSLHonorCipherOrder On
SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH !RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS
Header add Strict-Transport-Security "max-age=31536000"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment