Home » Forums » Support » General Discussion

New PCI SSLCipherSuite requirements

  • sgrayban
  • 06/20/07
  • Offline
Posted: Thu, 2011-10-27 15:03

I just finished a long conference call with my PCI compliant provider and VISA.

After testing on several servers I found some weakness in the current SSLCipherSuite in both webmin and usermin plus normal SSL sites.

The following information came from testing at https://www.ssllabs.com/ssldb/ and info from http://blog.ivanristic.com/2011/10/mitigating-the-beast-attack-on-tls.html

The Cipher's that both my PCI provider and I came up with that will be the best security for any SSL attacks is.....

ECDHE-RSA-AES256-SHA384:AES256-SHA256:AES256-SHA256:RC4:HIGH:!MD5:!SSLv2:!ADH:!aNULL:!eNULL:!NULL:!DH:!ADH:!EDH:!AESGCM

For apache these lines are now required by my PCI provider and other providers will be contacted to update their requirements in a few days.

SSLHonorCipherOrder     On
SSLCipherSuite          ECDHE-RSA-AES256-SHA384:AES256-SHA256:AES256-SHA256:RC4:HIGH:!MD5:!SSLv2:!ADH:!aNULL:!eNULL:!NULL:!DH:!ADH:!EDH:!AESGCM

Both Webmin and Usermin must be updated to use those Cipher's in that order to maintain PCI compliance.

I will be updating my PCI docs to include the new settings that will be required.

If anyone has questions you can contact me directly via email (sgrayban[at]gmail.com) or via phone +1.509.279.0985


Fix not sufficient for OpenSSL Version 0.9.7

  • SluggerOToole
  • 12/11/12
  • Offline
  • Tue, 2012-12-11 18:28
  • Copy comment link

Using this for SSLCipherSuite worked for me with OpenSSL version 0.9.8 but didn't work with 0.9.7 to mitigate the BEAST.

openssl ciphers -v 'ECDHE-RSA-AES256-SHA384:AES256-SHA256:AES256-SHA256:RC4:HIGH:!MD5:!SSLv2:!ADH:!aNULL:!eNULL:!NULL:!DH:!ADH:!EDH:!AESGCM'

Between OpenSSL version the cipher suites will be same except for the following:

0.9.7 has: 

EXP1024-RC4-SHA         SSLv3 Kx=RSA(1024) Au=RSA  Enc=RC4(56)   Mac=SHA1 export
where 0.9.8 doesn't

and 0.9.8 has: 

AES128-SHA              SSLv3 Kx=RSA      Au=RSA  Enc=AES(128)  Mac=SHA1

where 0.9.7 doesn't.

Not 100% sure it's the OpenSSL version creating the difference. My two servers are running CentOS 4.x and 5.x. So, they're generally similar but not identical.