OpenSSL Ciphers

Yet another article about why my cipher string is better than yours

(updated: Dec 2021)

There are several very good articles about hardening OpenSSL ciphers. Over the years I’ve combined lessons learned from others, my own research of standards and best practices, and my own real-life experiences to come up with the OpenSSL cipher string that I’ve found works best. My goal with this string is to provide the best security while minimizing the number of ciphers to maximize handshake performance.

Only TLS1.2 and TLS1.3 with only ECDHE and primarily AES ciphers in GCM mode. A CBC cipher is included and only necessary to support Microsoft’s legacy browser (Internet Explorer). CBC will show up as weak on Qualys’ SSL Server Test but the weakness does not actually exist unless certain Poodle vulnerabilities also exist; so make sure to keep your server software up to date. I also include the ChaCha20-Poly1305 cipher for supported browsers on mobile devices and other systems that do not have hardware acceleration.

The String

ECDH+CHACHA20:ECDH+AESGCM+AES128:ECDH+AESGCM:ECDH+AES128:ECDH+AES256:!aNULL:!SHA1:!AESCCM

You can test is on your OpenSSL installation

openssl ciphers -v 'ECDH+CHACHA20:ECDH+AESGCM+AES128:ECDH+AESGCM:ECDH+AES128:ECDH+AES256:!aNULL:!SHA1:!AESCCM'

It should result in the following cipher suites in the following order. You notice that the TLSv1.3 ciphers (the first three) do not follow the priority we defined to put AES128 above AES256.

TLS_AES_256_GCM_SHA384
TLS_CHACHA20_POLY1305_SHA256
TLS_AES_128_GCM_SHA256
ECDHE-ECDSA-CHACHA20-POLY1305
ECDHE-RSA-CHACHA20-POLY1305
ECDHE-ECDSA-AES128-GCM-SHA256
ECDHE-RSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES256-GCM-SHA384
ECDHE-RSA-AES256-GCM-SHA384
ECDHE-ECDSA-AES128-SHA256
ECDHE-RSA-AES128-SHA256
ECDHE-ECDSA-AES256-SHA384
ECDHE-RSA-AES256-SHA384

Prioritization Logic

• AESGCM ciphers are normally preferred over everything else.
• CHACHA20 is preferred to AESGCM on browsers that support it. Without this top preference, the systems that would benefit most (mobile devices) would not normally use it.
• AES-128 is preferred to AES-256. AES-256 provides little improvement to security, while AES-128 is faster making it less taxing in virtual server environments and more resistant to timing attacks.
• CCM ciphers are secure, but very poor performers and not widely used.
• SHA1 is vulnerable to attacks, so no SHA1 based ciphers

Apache

Apache has a separate config entry for TLSv1.3 cipher suite order.

SSLEngine on
SSLProtocol -All +TLSv1.2 +TLSv1.3
SSLCipherSuite ECDH+CHACHA20:ECDH+AESGCM+AES128:ECDH+AESGCM:ECDH+AES128:ECDH+AES256:!aNULL:!SHA1:!AESCCM
SSLCipherSuite TLSv1.3 TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384
SSLHonorCipherOrder On

Nginx

Nginx also has a separate config entry for TLSv1.3 cipher suite order.

ssl_prefer_server_ciphers On;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_conf_command Ciphersuites TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384;
ssl_ciphers ECDH+CHACHA20:ECDH+AESGCM+AES128:ECDH+AESGCM:ECDH+AES128:ECDH+AES256:!aNULL:!SHA1:!AESCCM;

more to come…