CODEWITHSUNDEEP
apachesecuritysslhttpstls1.2
mountain.penguin
mountain.penguin

Reputation: 11

Need help in BEAST attack prevention for DV SSL

I recently purchased the SSL from SSL 123 DV Thawte Inc for one of my client's domain. Post installation of the certificate I checked the domain using crypto-checker provided by Thawte.

I received an alert stating the site is open to BEAST Attack vulnerability.

To dig deeper, I used SSLLabs to identify the Insecure Ciphers.

Following are the Ciphers identified as not secured. I need help in closing these holes.

Screenshot of in secured ciphers

Screenshot of insecured ciphers

I am using Apache 2.4 web server over Ubuntu 16 64 Bit.

Upvotes: 0

Views: 244

Answers (1)

covener
covener

Reputation: 17886

Any up to date browser has circumventions for BEAST, meanwhile I don't think those ciphers are flagged because of BEAST in the SSL Labs report. It turns out the BEAST alternatives needed for a high level of compat (rc4) are worse then the previously BEAST-affected ciphers.

You should use an alternate SSLCipherSuite to make sure weak ciphers are at the bottom instead of that one you have at the top. Instead of trying to ad-lib it, you should start with a config from https://mozilla.github.io/server-side-tls/ssl-config-generator/

Upvotes: 1

Related Questions