Note: SSLv3 or older protocols as well as TLS 1.0 and 1.1 should no longer be used. Use TLS 1.2 should be used instead.
?Recommendations for Microsoft Internet Information Services (IIS):
Changing the SSL Protocols and Cipher Suites for IIS involves making changes to the registry. It is not direct or intuitive. Therefore, instead of repeating already published information, please see the Microsoft TechNet articles below:
Recommendations for Apache/mod_ssl:
High security. TLS1.2 only. Not compatible with some client web browsers:
The SSLProtocol and SSLCipherSuite directives below are meant for high security information exchange between server and client. However, the user will need to use a recent web browser: Firefox > 70, Chrome > 79, Microsoft Edge, IE > 11. This is because the resulting cipher suites require TLSv1.2.
SSLProtocol all -TLSv1.1 -TLSv1 -SSLv2 -SSLv3
SSLCipherSuite ALL:+HIGH:!ADH:!EXP:!SSLv2:!SSLv3:!MEDIUM:!LOW:!NULL:!aNULL
SSLHonorCipherOrder on
Apache Tomcat Using Java Secure Socket Extension (JSSE):
Apache Tomcat uses JSSE connector by default, as oppose to the Apache Portable Runtime (APR). Below are recommended cipher suites:
ciphers="TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
TLS_RSA_WITH_AES_128_CBC_SHA,
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
TLS_RSA_WITH_AES_128_CBC_SHA256,
TLS_RSA_WITH_AES_128_GCM_SHA256,
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
TLS_RSA_WITH_AES_256_CBC_SHA,
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
TLS_RSA_WITH_AES_256_CBC_SHA256,
TLS_RSA_WITH_AES_256_GCM_SHA384,
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
Example JSSE Connector settings in $TOMCAT_BASE/conf/server.xml file:
<!-- JSSE Connector -->
<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"
maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS" sslEnabledProtocols="TLSv1.2,TLSv1.1,TLSv1"
keystoreFile="/path/to/keystore.jks"
keystorePass="keystorepasswordhere"
ciphers="TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
TLS_RSA_WITH_AES_128_CBC_SHA,
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
TLS_RSA_WITH_AES_128_CBC_SHA256,
TLS_RSA_WITH_AES_128_GCM_SHA256,
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
TLS_RSA_WITH_AES_256_CBC_SHA,
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
TLS_RSA_WITH_AES_256_CBC_SHA256,
TLS_RSA_WITH_AES_256_GCM_SHA384,
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
/>
Apache Tomcat with Apache Portable Runtime (APR) Connector:
SSLProtocol="all -SSLv2 -SSLv3"
SSLCipherSuite="ALL:+HIGH:+TLSv1:!DH:!ADH:!EXP:!SSLv2:!MEDIUM:!LOW:!NULL:!aNULL"
SSLHonorCipherOrder="on"
Example APR Connector settings in $TOMCAT_BASE/conf/server.xml file:
<!--APR connector-->
<Connector protocol="org.apache.coyote.http11.Http11AprProtocol"
port="8443" maxHttpHeaderSize="8192"
maxThreads="150"
enableLookups="false" disableUploadTimeout="true"
acceptCount="100" scheme="https" secure="true"
SSLEnabled="true"
SSLCertificateFile="/path/to/certificate.cer"
SSLCertificateKeyFile="/path/to/private.key"
SSLCertificateChainFile="/path/to/intermediate/certificate/bundle.cer"
SSLProtocol="all -SSLv2 -SSLv3"
SSLCipherSuite="ALL:+HIGH:+TLSv1:!DH:!ADH:!EXP:!SSLv2:!MEDIUM:!LOW:!NULL:!aNULL"
SSLHonorCipherOrder="on"
/>
Further Reading:
To test your web server's SSL configuration, please visit SSL Labs.
For more information, please visit the office Apache mod_ssl documentations:
For more information regarding Transport Layer Security (TLS) as well as a compiled list of supported web browsers, please see this Wikipedia article.