2

I would like to be proactive and disable weak ciphers on my web servers, such as TLS_RSA_WITH_3DES_EDE_CBC_SHA. However I am concerned with inadvertently cutting off users who make use of older system.

Is there a good resource only that provides statistics on the current % of browser users who require a specific cipher in order to connect via https?

Alternatively, is there a way to get that information by parsing/processing the user agent string from my server logs?

3

While it doesn't specifically address the approaches you ask about, Qualys SSL Labs Server Test emulates the behavior of a wide number of clients and allows you to see which clients would be unable to communicate with the current configuration. In this snip from the current grade for security.stackexchange.com, you can see that IE 6 / XP is not compatible.

security.stackexchange.com client compatibility

You can spin up a test site for the purpose of experimenting with different configurations, and correlate what you learn against the user agents found in your logs before shifting the configuration to your live site.

1

It's always best to see what the impact will be on your traffic, since TLS support varies among different countries, different types of businesses, between mobile and desktop clients, and various other populations.

You can log the TLS versions and cipher suites used in Apache httpd and nginx. Once you've done that, wait a week (or however long you feel is necessary to get an accurate representation of your site's traffic) and then you can build a report of the requests using the configurations you want to disable.

It's important to remember that just because a client used a particular cipher suite, that doesn't mean they have to - they may fall down to another supported cipher suite if that one's no longer allowed. If you want to try to figure this out, pull out the user agents that are using the endangered cipher suite, use a tool to reverse the client name out of the user agent, and then you can test using that client (assuming it's a well-known one) to see what happens in your testing environment.

  • Is there a way to log cipher suites using windows server and IIS? – Aheho Jun 13 '17 at 12:58
  • @Aheho Probably, but the details on how to do that would be a question for Server Fault. – Xiong Chiamiov Jun 13 '17 at 18:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.