Hacker News Reader

Thanks, this is helpful. Which CBC suites work in TLS 1.1, but not 1.0?

These are my test results: https://www.ssllabs.com/ssltest/analyze.html?d=forkly.com

In general, I don't think the protocol specifications call for some suites to be allowed with certain protocol and some not to. (There are some exceptions, when weak suites need to be deprecated.) In practice, it comes down to how library developers have implemented them. For example, in OpenSSL, you have SSL v2 suites, TLS 1.2 suites, and >= SSL v3 suites. I don't think there are any TLS 1.1-only suites.

Okay, then my current config is probably as good as it gets for now.

Thanks for the help :)

Reply on news.ycombinator.com