Recently, Amazon upgraded their Elastic Load Balancer to support Sever Cipher Ordering and ECDHE Ciphers. These ciphers are what are recommended for implementing Forward Secrecy as recommended by Qualys in their Best Practices document.
The following configuration gives me an A on Qualys’s SSL Labs.
- Select Custom Security Policy
- SSL Protocols
- Select ‘Protcol-TLSv1′, ‘Protocol-TLSv1.1′ and ‘Protocol-TLSv1.2′
- SSL Options
- Select ‘Server Order Preferences’
- SSL Ciphers – Select the following list:
As a side note:
This configuration disables IE6 from even viewing your site over SSL, as it does not support TLS1.0+. We also include DES-CBC3-SHA / TLS_RSA_WITH_3DES_EDE_CBC_SHA so that IE8 on Windows XP will work. If you don’t care about IE8/WINXP, then feel free to disable this cipher as well. RC4 was recommended to mitigate against the BEAST attack, but all major browsers have patched against BEAST so we don’t care about that as much any more.
To get an A+ on SSL Labs, have your web server add the following header for sites that are forcing SSL (nginx in this example):
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";