Mobile app version of vmapp.org
Login or Join
Sarah324

: What cipher suites should I consider on government website I maintain a website for the government, which is http only. The target audience is all civilian, so the browser client may be very

@Sarah324

Posted in: #Https #Security #WebHosting

I maintain a website for the government, which is http only. The target audience is all civilian, so the browser client may be very old down to IE6.

Recently they request to upgrade the site to https. I scratch my hair that don't know what protocol and cipher suits should I use.

refer to Mozilla recommendations, is the "Old backward compatibility" right for us?

If the reader using most modern version of browser, is the security level lower than "Intermediate compatibility (default)" or "Modern compatibility"?

10.01% popularity Vote Up Vote Down


Login to follow query

More posts by @Sarah324

1 Comments

Sorted by latest first Latest Oldest Best

 

@Si4351233

Given some inherent security issues with SSL it tends to be best to disable SSLv3 and lower and stick to TLS 1.0+ however if there is a high chance of substantially old browsers connecting that only support SSL3 then the only real choice is to enable SSL3 as well. This really is something better checked with your government's IT services department to check what the regulatory and organisational requirements are within your government.

10% popularity Vote Up Vote Down


Back to top | Use Dark Theme