I'm searching for a cipher suite for my HTTPS website, running on the Apache 2 web server, that would offer a good compromise between compatibility with users and security. One idea I had was to simply using the same cipher suite that Google uses, i.e.:
Accepted TLSv1 256 bits ECDHE-RSA-AES256-SHA Accepted TLSv1 256 bits AES256-SHA Accepted TLSv1 128 bits ECDHE-RSA-AES128-SHA Accepted TLSv1 128 bits AES128-SHA Accepted TLSv1 112 bits DES-CBC3-SHA Accepted TLS11 256 bits ECDHE-RSA-AES256-SHA Accepted TLS11 256 bits AES256-SHA Accepted TLS11 128 bits ECDHE-RSA-AES128-SHA Accepted TLS11 128 bits AES128-SHA Accepted TLS11 112 bits DES-CBC3-SHA Accepted TLS12 256 bits ECDHE-RSA-AES256-GCM-SHA384 Accepted TLS12 256 bits ECDHE-RSA-AES256-SHA384 Accepted TLS12 256 bits ECDHE-RSA-AES256-SHA Accepted TLS12 256 bits AES256-GCM-SHA384 Accepted TLS12 256 bits AES256-SHA256 Accepted TLS12 256 bits AES256-SHA Accepted TLS12 128 bits ECDHE-RSA-AES128-GCM-SHA256 Accepted TLS12 128 bits ECDHE-RSA-AES128-SHA256 Accepted TLS12 128 bits ECDHE-RSA-AES128-SHA Accepted TLS12 128 bits AES128-GCM-SHA256 Accepted TLS12 128 bits AES128-SHA256 Accepted TLS12 128 bits AES128-SHA Accepted TLS12 112 bits DES-CBC3-SHA
Presumably, Google has chosen their cipher suite to be compatible with most people's browsers, while also being very secure, so it seems that this should be a good choice for a cipher suite in general. But since I'm only running a small website, I'm not entirely convinced that what's good for Google is also good for me. So my questions would be:
- Are there any ciphers in the suite above that I should not use? And if so, why?
- Are there any other ciphers that I really should allow, even though Google doesn't?