|
|
|
|
|
|
|
|
|
|
| Re: How to disable the RC4 cipher? [message #119628 is a reply to message #119615] |
Tue, 24 February 2015 14:05   |
gabrielbraga
Messages: 16
Registered: March 2014
|
|
|
|
In ssllabs.com test I'm receiving grade B, and them justify with these two lines:
This server accepts the RC4 cipher, which is weak. Grade capped to B. MORE INFO »
The server does not support Forward Secrecy with the reference browsers. MORE INFO »
|
|
|
|
|
|
|
|
|
|
| Re: How to disable the RC4 cipher? [message #119938 is a reply to message #119886] |
Wed, 11 March 2015 23:18 |
mlee (Kerio)
Messages: 211
Registered: October 2012
Location: Sydney
|
|
|
|
Once again, with some great help and here's an update for you:
RC4-SHA was re-added to Kerio Control as a fallback cipher suite for software which doesn't support Diffie Hellman key exchange (Kx=DH). Now we do understand that there are vulnurabilities with RC4, we also need to consider that there are users with older software that requires the use of Kx=RSA.
The only safe choice these days are cipher suites which provide Perfect Forward Secrecy.
While there are plans to further improve the security on Kerio Control, at this stage you can disable RC4 by setting EnableKxRSA=0 in winroute.cfg, but be warned that lot of (mostly old) clients stop working, because they have no cipher suites capable of Kx=DH.
M.
PTSD. BP. OCD. ASPD. BPD. Certified.
[Updated on: Wed, 11 March 2015 23:19] Report message to a moderator |
|
|
|
|
|
|
|
Members
Search
Help
Register
Login
Home
