We are hosting an SaaS website and API with the https protocol, both of which are accessed by numerous users with a lot of different browsers and client-side apps. What would happen if I made PFS mandatory in my IIS Web Server's configuration? Could there be problems with incompatible clients which do not know how to handle PFS?

migrated from crypto.stackexchange.com Dec 5 '13 at 13:51

This question came from our site for software developers, mathematicians and others interested in cryptography.

  • If you support both ECDHE_RSA and DHE_RSA, you'll support most clients. AFAIK Internet explorer on Windows XP doesn't support either. But there is little reason to completely disable RSA, it's enough to ensure that it's only chosen when no better suite is available. – CodesInChaos Nov 25 '13 at 13:09
  • @CodesInChaos don't you think the connection will be vulnerable to MITM? SSL parameres exchange is done in plaintext. – Smit Johnth Nov 26 '13 at 7:27
  • @SmitJohnth I don't get your point. SSL's MitM prevention is as good as the certificate validation. It doesn't matter if SSL parameters are in the clear. – CodesInChaos Nov 26 '13 at 8:32
  • @CodesInChaos Are SSL connection parameters part of certificate? – Smit Johnth Nov 26 '13 at 15:20
  • 1
    @SmitJohnth - since SSL 3.0 this has been protected. Once the cipher has been agreed the negotiation phase is repeated, but encrypted this time, and if it doesn't match the original, the connection is dropped. – paj28 Dec 5 '13 at 14:04

All major browsers support ECDHE: IE since IE7 (on Vista and newer), and Chrome and Firefox for even longer. However, Windows XP users of IE do not get ECDHE support, and even though Windows XP is past end-of-life, people are still using it. If you want to allow XP users, then I suggest just putting the ECDHE modes at the top of your cipher preference string. If you value PFS over Windows XP users, then create a cipher preference string with only ECDHE modes.

Qualsys's SSL Labs has a great article on deploying PFS, and of course their checker will help you figure out which browsers will negotiate with which cipher suite.


Most of the modern webbrowsers do support PFS. I would recommend you to check your server configuration with https://www.ssllabs.com/ssltest/

You may check the capabilities of specific browser explicitely as well here https://www.ssllabs.com/ssltest/viewMyClient.html


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.