In the AWS ELB, I have uploaded a cert and only selected "RC4-MD5" + "RC4-SHA" as the ciphers and scored A in the ssltest [1]

If I using the default ELB setting, I can only score a C

Since I am not doing a PCI compliant site, so by using only the above two ciphers, is it enough for most purpose? (by enough I mean wide range of browser support)

[1] https://www.ssllabs.com/ssltest/


Short answer: yes, things will be fine.

RC4, MD5 and, in some minor measure, SHA-1 all have some known shortcomings, but none of them will make your Web site weak. To be accurate: if using a RC4-MD5 cipher suite makes your Web site significantly weaker, then it is otherwise extremely solid -- more solid than seems to be practically reachable, indeed.

However, you might want to throw in a few more cipher suite, e.g. with support for 3DES and/or AES, so as to accommodate restricted clients. Some people got the messages wrong, panicked, and deactivated RC4 altogether from their browsers.

The "score" in ssltest is nigh meaningless. Don't read too much in it. It is like reputation in security.SE: it more relates to the efforts invested in obtaining a high score than to real security.

  • 2
    Despite Thomas's own high reputation on Sec.SE, his answers are solid with respect to "real security". In other words if a given website suffers from SQL injection (etc) RC4 is the least of your concerns. – goodguys_activate Jul 22 '13 at 17:28
  • Do keep in mind that MD5 for certificate signatures is definitely bad, though. – Polynomial Jul 22 '13 at 19:18
  • Yes -- but that's not the same MD5. The MD5 in a certificate signature is the one chosen by the CA; it has no relation with the MD5 in SSL cipher suites. Also, arguably, MD5 can still be used safely in signatures as long as the input is suitably randomized (in the case of certificates, as long as the CA generates unpredictable serial numbers for the certificates it issues). – Thomas Pornin Jul 22 '13 at 19:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.