http/2 needs "weaker" ciphers?
mdounin at mdounin.ru
Mon Oct 19 16:44:59 UTC 2015
On Mon, Oct 19, 2015 at 10:23:40AM -0400, p.heppler wrote:
> The blacklist note says:
> This list includes those cipher suites that do not offer an ephemeral key
> exchange and those that are based on the TLS null, stream, or block cipher
> type (as defined in Section 6.2.3 of [TLS12]).
> But AES256+EECDH:AES256+EDH doesn't match this blacklist because those are
> all ephemeral key exchange ciphers, aren't they?
The blacklist in question includes not only ciphers without
ephemeral key exchange, but also ciphers using various algoritms.
In my tests, use of the AES256+EECDH:AES256+EDH cipher
specification results in ECDHE-RSA-AES256-SHA being negotiated
with Chrome. And it is on the list:
Likely it's blacklisted due to use of SHA1.
More information about the nginx