Confirmed users
529
edits
Security/Server Side TLS: Difference between revisions
Jump to navigation
Jump to search
m
→Zeus (Riverbed Stingray)
| Line 314: | Line 314: | ||
ELBs support HAproxy's proxy protocol, that removes the need for X-Forwarded-For and operates with a header placed right before the TCP packet. While still in beta, a solution composed of L4 ELBs that send TCP traffic to HAproxy for SSL termination would solve the limitations above. | ELBs support HAproxy's proxy protocol, that removes the need for X-Forwarded-For and operates with a header placed right before the TCP packet. While still in beta, a solution composed of L4 ELBs that send TCP traffic to HAproxy for SSL termination would solve the limitations above. | ||
== Zeus (Riverbed Stingray) == | == Zeus Load Balancer(Riverbed Stingray) == | ||
ZLB supports TLS1.1 and OCSP Stapling. It lacks support for TLS 1.2, Elliptic Curves and AES-GCM. | |||
ZLB takes only one global ciphersuite for all sites it manages. However, the OCSP Stapling setting is configurable per-site. | |||
The recommended prioritization is: | The recommended prioritization is: | ||
| Line 323: | Line 324: | ||
# AES256-SHA | # AES256-SHA | ||
# RC4-SHA | # RC4-SHA | ||
The following string can be used in the ZLB configuration, under global settings: | |||
<source lang="bash"> | <source lang="bash"> | ||
SSL_DHE_RSA_WITH_AES_128_CBC_SHA,SSL_DHE_RSA_WITH_AES_256_CBC_SHA,SSL_RSA_WITH_AES_128_CBC_SHA,SSL_RSA_WITH_AES_256_CBC_SHA,SSL_RSA_WITH_RC4_128_SHA | |||
</source> | </source> | ||
While the recommended DH prime size is 2048, problems with client libraries, such as Java 6, make this impossible to deploy for now. Therefore, a DH prime of 1024 bits should be used until all clients are compatible with larger primes. | |||
== Citrix Netscaler == | == Citrix Netscaler == | ||