4.5 Configuring Stronger Ciphers for SSL Communication

See the overview of Strengthening TLS/SSL Settings for information about strong ciphers.

Configuring Stronger Ciphers between Browsers and Access Gateway

Add or modify the advanced option as follows:

SSLCipherSuite !aNULL:!eNULL:!EXPORT:!DSS:!DES:!RC4:ALL:!EDH

NOTE:aNULL, eNULL and EXP ciphers are always disabled by default. Apache 2.2.30 onwards, null and export-grade ciphers are always disabled, as mod_ssl unconditionally prepends any supplied cipher suite string with !aNULL:!eNULL:!EXP: at initialization.

For more information about SSLCipherSuite Directive, see SSLCipherSuite Directive documentation.

Configuring Stronger Ciphers between Access Gateway and Web Servers

SSLProxyCipherSuite ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4:HIGH:MEDIUM:!LOW:!EXP:!SSLv2:!aNULL:!EDH:!ECDH:!ECDSA:!AESGCM:!eNULL:!NULL

While setting the cipher suite, ensure that the web server supports the cipher suite. For example, if Access Manager supports ECDH ciphers, but the web server does not support that, the connection will fail.