0

I build openssl-1.0.2l I used in my https server

I tried to test my https server with ssllabs. The ssllabs returns the following warning:

The server does not support Forward Secrecy with the reference browsers

can I fix that in the build options of openssl ?

Improve this question
1

1 Answer 1

Reset to default
1

can I fix that in the build options of openssl ?

The problem is not your OpenSSL build but the configuration of your unknown server. In order to enable forward secrecy you need to enabled ECDHE and/or DH cipher suites in the server configuration.

For examples of recommended configurations see Security/Server Side TLS.

Improve this answer
1
  • s/DH/DHE/. Also 1.0.2 needs setting tmp_dh or tmp_ecdh parameters or ecdh_auto mode at libssl level (these vary some with other OpenSSL versions) and whether the server application level defaults that for you or requires config varies.
    – dave_thompson_085
    Dec 6, 2017 at 9:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .