Hacker News Reader

Comment by jcampbell1 | Hacker News Reader

Can someone explain why we don't get ECDHE on ubuntu 12.04 by default?

On ubuntu 12.04 my apache has:

    SSLCipherSuite HIGH:MEDIUM:!ADH:!MD5

` openssl ciphers 'HIGH:MEDIUM:!ADH:!MD5'` shows a ton of ECDHE stuff in the list. I am not sure what it takes to get apache to use the ECDHE ciphers.

View on HN

Why not by default? Ask ubuntu and report a bug: https://bugs.launchpad.net/ubuntu/+source/apache2/+filebug

How to do it for yourself: https://news.ycombinator.com/item?id=5171250

I think your first link may be incorrect? I also tried looking through the tracker but I wasn't able to find a relevant bug associated with this. Would you mind posting the link to the bug?

The second link doesn't work as far as I can tell.

I think the person that says we need Apache 2.4 to get ECDHE is correct. Adding ECDHE ciphers to the Apache 2.2 config doesn't seem to do anything. Following the advice in the second link actually turns off PFS for chrome compared to the default setup.

I have a bad habit of linking to HN posts and assuming that people understand I mean "look at the comments." The Cloudflare instructions break chrome? That is my bad, I have not verified them myself recently. I usually use the cloudflare settings or jacob's duraconf[1]. Thanks to joeyh's mr I usually have duraconf checked out on any machine that I use.

[1] https://github.com/ioerror/duraconf

Yes, the cloudflare advice does break chrome PFS. With the defaults, chrome shows:

    CAMELLIA_256_CBC, with SHA1 for message 
    authentication and DHE_RSA as the 
    key exchange mechanism.

By changing to the suggestion in the comments, the encryption downgrades to:

    The connection is encrypted using RC4_128,
    with SHA1 for message authentication and 
    RSA as the key exchange mechanism.

Yeah, I actually just noticed that cloudflare was using nginx so the qualys scan was not indicative of the cloudflare apache setup. I apologize I got distracted watching those genetic cars.

See my comment in the second link for what I use for nginx. I prefer explicitly stating ciphers to make sure only the ones I want presented are used

I am sorry, my link was correct but the context was incorrect. The link is to submit a new bug for apache in ubuntu's bug tracker. I changed the text so that it is clear that I am suggesting that a bug be filed.

In my opinion pubic issue trackers are one of the greatest features of open source software and under utilized. Since there are no open or closed bugs I imagine the most likely answer for why it is not on by default is "nobody asked or not enough people asked." If enough people say "this applies to me" on a bug in launchpad the maintainers will recognize that it is an important feature for users. If there is a reason why it is not on by default the WONTFIX bug report will provide an answer for other people who are curious.

Unfortunately individual applications need to add support for ECDHE for it to be usable, and Apache 2.2 does not have such support. Apache 2.4 does though.

(Corroboration: http://vincent.bernat.im/en/blog/2011-ssl-perfect-forward-se...)

I'm still investigating/experimenting myself, but if I understand properly what I've read so far, you can change that to:

SSLCipherSuite HIGH+DH:MEDIUM+DH:!ADH:!MD5

to require PFS. I'm not sure how many browsers that'll break (I have doubts about broad coverage for Safari/Opera/IE).

I would like to also include ECDHE ciphers but I'm having a hard time coming up with a line that does not include ECDH. Any ideas?

State the cipher explicitly. Then there is no chance of error. See my comment above.

Reply on news.ycombinator.com