I've worked with TLS certs before, but only on a basic level. I'm trying to understand some specific recommendations for implementing TLS (quoted below).
(For context, my goal is to secure HTTPS connections to a web page which collects user information via a form.)
Here are the recommendations (they are from this article):
If you are not a government organization but have HIPAA-compliance requirements and have to interact with people using a wide array of systems and devices, we would recommend the following:
- Support TLS 1.0, 1.1, and 1.2+
- Use all of the non-DES ciphers from [certain lists]
Below is my attempt at interpreting this. I'm hoping you can tell me what I've gotten right or wrong.
The TLS version is a property of the connection (in my case, between the browser and the web server) – not a property of the certificate. In other words, when I see "Protocol: TLS 1.2" in the Security tab of Chrome's dev tools, it means that the browser is communicating with the server using version 1.2 of the TLS protocol. It doesn't make sense to talk about the TLS version of a certificate.
The recommendation to support many different ciphers only applies if I'm implementing a TLS client. In my case, the browser is the client – so, when I generate my cert, I just need to choose a single cipher which (a) is on the approved list, and (b) is supported by all major browsers.
Is this accurate? Inaccurate?