ssl_protocols和ssl_ciphers應該怎么配置

http://wiki.nginx.org/HttpSslModule#ssl_ciphers

 

推薦配置：

 

A) 在Apache 的 SSL 配置中禁用 SSLv3 和 SSLv3
SSLProtocol all -SSLv2 -SSLv3
SSLCipherSuite HIGH:!aNULL:!MD5:!EXPORT56:!EXP


B) 在 Nginx 只允許使用 TLS 協議： 
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!MD5:!EXPORT56:!EXP;

 

apche配置：

<!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443

         This connector uses the NIO implementation that requires the JSSE

         style configuration. When using the APR/native implementation, the

         OpenSSL style configuration is required as described in the APR/native

         documentation -->

    <!--

    <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"

               maxThreads="150" SSLEnabled="true" scheme="https" secure="true"

               clientAuth="false" sslProtocol="TLS" />

    -->