I'm looking at turning on site-wide SSL for a website I manage, and I'm wondering what the best practices for SSL configuration. I'm not too worried about compatibility with old browsers and more obscure mobile devices, so I'd like to cut down the supported cipher suite list.
The main issues I'm trying to avoid are CRIME and BEAST. The first one is easily mitigated by disabling compression, but the second one isn't quite as clear to me. The way I understand it, BEAST is an attack against CBC mode rather than a particular cipher, but it's generally been targeted against AES. As such, would AES-GCM be a good choice of cipher to use for SSL?