Yeps I agree on that point. Wonder what the others think of this?<br><br>Just for reference/discussion, I set my SSL parameters to be as such:<br>ssl_protocols SSLv3 TLSv1;<br>ssl_ciphers HIGH:MEDIUM:!SSLv2:!aNULL:@STRENGTH;<br>
<br>Ray<br><br><div class="gmail_quote">On Sun, Oct 4, 2009 at 6:07 AM, Matt Goodall <span dir="ltr"><<a href="mailto:matt.goodall@gmail.com">matt.goodall@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Hi,<br>
<br>
I just noticed that the SSL module enables SSLv2 by default,<br>
"ssl_protocols SSLv2 SSLv3 TLSv1 " (see<br>
<a href="http://wiki.nginx.org/NginxHttpSslModule#ssl_protocols" target="_blank">http://wiki.nginx.org/NginxHttpSslModule#ssl_protocols</a>).<br>
<br>
Given that SSLv2 is generally considered "weak" these days<br>
(<a href="http://en.wikipedia.org/wiki/Secure_Sockets_Layer#Security" target="_blank">http://en.wikipedia.org/wiki/Secure_Sockets_Layer#Security</a>) and is<br>
disabled in most modern browsers would it make sense to change the<br>
default to "ssl_protocols SSLv3 TLSv1"?<br>
<font color="#888888"><br>
- Matt<br>
<br>
</font></blockquote></div><br>