TLS_FALLBACK_SCSV
Dewangga Bachrul Alam
dewanggaba at xtremenitro.org
Fri Oct 17 14:30:56 UTC 2014
Hi there,
Regarding POODLEbleed[1] issue, I've disable SSLv3 on `ssl_protocols`
directive. But, ssllabs.com says that :
---- snip ----
Downgrade attack prevention No, TLS_FALLBACK_SCSV not supported (more
info[2])
---- snip ----
But on LiteSpeed[3] configuration, it says yes.
---- snip ----
Downgrade attack prevention Yes, TLS_FALLBACK_SCSV supported
---- snip ----
With configuration:
---- snip ----
SSLHonorCipherOrder On
SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2
---- snip ----
$ nginx -v
nginx version: nginx/1.6.2
built by gcc 4.4.7 20120313 (Red Hat 4.4.7-4) (GCC)
TLS SNI support enabled
[snip]
--add-module=/home/mockbuild/rpmbuild/SOURCES/ngx_pagespeed-release-1.9.32.1-beta
So the question is, how important it is?
---- Reference
[1] http://nginx.com/blog/nginx-poodle-ssl/
[2] https://datatracker.ietf.org/doc/draft-bmoeller-tls-downgrade-scsv/
[3] http://www.litespeedtech.com/products/litespeed-web-server/release-log
More information about the nginx
mailing list