3

For eg. TLS 1.1 only RC4 suites, TLS 1.2 only GCM suites etc

Also, Can it have Different cipher suite preference order (i.e. different order for different version)?
eg. RC4 on top of list for SSL 3 and last for TLS 1.0, 1.1 1.2

Does any web server provides such functionality Apache, Nginx, IIS etc?

7

In theory it would be possible to set the available ciphers and cipher order depending on the TLS protocol version used by the client. In practice none of the common web servers supports this.

Apart from that it is questionable what use this feature would have because cipher selection is done based on the ciphers the client offers. For example if the client does not offer GCM ciphers with TLS 1.2 (which is possible) then the handshake would actually fail if only GCM ciphers are available on the server side with TLS 1.2. Thus the main purpose would probably only to trick analysis tools like SSL Labs to make it look like the site does not support RC4 even if it does for older clients.

0

In NGINX you can provide lists of protocols and ciphers, it looks like that:

ssl_protocols *insert protocols here*;
ssl_ciphers *insert ciphers here*;

you can put this either into your vhost config, or, if you use multiple vhosts, you can put it into a separate file and just include it in your vhosts

  • This shows how to configure protocol and ciphers in general but does not address the question of the OP, i.e. if it is possible to have cipher selection depend on the TLS protocol the client uses. – Steffen Ullrich Aug 2 '16 at 6:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.