1
vote
4answers
2k views

nginx recommended ssl_ciphers for security, compatibility - with PFS

I'm currently using nginx with the following ciphers: ssl_ciphers HIGH:!aNULL:!eNULL:!LOW:!ADH:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS; I would like to maintain compatibility to older ...
6
votes
1answer
677 views

What's the hash for in ECDHE-RSA-AES-GCM-SHA?

Presumably the SHA is for deriving the AES key from the shared secret. Where else is the hash used? ECDH just does ECC (no hashing). RSA does masking and padding but this doesn't involve the ...
3
votes
2answers
360 views

Should I customize my Root CA's thumbprint/fingerprint? (SHA1 or MD5)

My goal is to make a certificate's thumbprint "easier" to verify, and not reduce security in doing so. Given that the RSA-based Bitcoin technology has a concept called a "Vanity address" where the ...