Should a server set a cipher order?

Question

I've seen conflicting opinions on whether or not setting a cipher order is recommended. testssl.sh prints a red warning when no cipher order is encountered, implying that a lack of cipher order is considered a deficit. It also makes intuitive sense that a server should begin by offering the strongest ciphers first, and only then offer weaker ciphers.

Mozilla on the other hand recommends not setting a cipher order, as the client will know best which ciphers they prefer (e.g. depending on which ciphers have hardware support).

So, which one is it? Should a server cipher order be set or not?

Answer 1

... a server should begin by offering the strongest ciphers first, and only then offer weaker ciphers.

As long as the server only supports ciphers which are strong enough it does not actually matter in terms of security who chooses the cipher. Instead of security other criteria are relevant, typically performance from the perspective of the client or of the server. Just using a "stronger" cipher might add a perceived value but not an actual value (still assuming that only sufficiently string ciphers are supported in the server).

See also Do TLS standards require the server-side preference to always be used when negotiating ciphers to use? on why one would prefer client cipher order or why not.

Answer 2

I don't think the order is relevant from a security perspective. The only thing that is relevant is whether the ciphers are considered safe or not; that's why, in general, you should remove the weak ciphers from the server list. Bear in mind that the client will choose from what the server offers to the client, and it is up to the clients to choose one depending on what they have implemented or what hardware they have. I know that in openssl you can choose the order, and it looks nice to have it, but it is up to the client to choose one from that list depending on their requirements.