From ba8037b4bdc48c9f98acdc7b4b51f0192f472e12 Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Thu, 27 Dec 2018 06:22:37 -0500 Subject: [PATCH] feat: switch to move secure ssl ciphers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The cipher list is from from https://cipherli.st/ and will remove a few older browsers: - Android 5.0 - Android 6.0 - Chrome 49 / XP SP3 - Firefox 31.3.0 ESR / Win 7 - Firefox 47 / Win 7  R - IE 11 / Win Phone 8.1 I _think_ thats an okay drop - dropping Android kinda hurts, but we're far from the only ones dropping them from being served, and our users are free to override these settings on their own servers. Closes #3343 --- plugins/nginx-vhosts/install | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugins/nginx-vhosts/install b/plugins/nginx-vhosts/install index d35190584..348f4e813 100755 --- a/plugins/nginx-vhosts/install +++ b/plugins/nginx-vhosts/install @@ -47,7 +47,7 @@ ssl_session_timeout 1d; ssl_session_tickets on; ssl_dhparam /etc/nginx/dhparam.pem; -ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS; +ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384; EOF