Forums.FreeBSD.org - SSL Issue?

[Karl Denninger]

On 5/14/2015 10:20, Patrick Proniewski wrote:
> On 14 mai 2015, at 16:13, jungle Boogie wrote:
>
>> On 14 May 2015 at 06:08, Mark Felder <feld at freebsd.org> wrote:
>>> TLS 1.0 is dead and is even now banned in new installations according to
>>> the PCI DSS 3.1 standards. Nobody should expect TLS 1.0 to be supported
>>> by *any* HTTPS site now.
>>
>> Here, here! We ONLY have 1.0 enabled until the hardware vendor can
>> upgrade their software. I'm looking to celebrate the day when we have
>> 1.1 and 1.2 enabled.
>
> That's always the problem with guys like you and me who live in the real world. We can't cope with "what should be dead and no longer used". Deprecated tomcat/Java/SSL/You-name-it software that you can't just upgrade because it's used with hardware/software you can't get rid of.
> At work we are in the ridiculous state where we have to package old browser + old Java into VMware ThinApp "bubbles" to access production tools.
>
> Removing TSL 1.0 is not a good move. It's possible to provide SSL with TLS 1.2, having protection against protocol downgrade, and still provide TLS 1.1 and 1.0 for older browsers.
>
> patpro
> _______________________________________________
>

I'd love to lock out TLS 1.0 but if you do that anyone still running
anything that uses XP cannot connect.

There ARE people out there still using that in the wild.  Not a huge
number, but a material number.  On several relatively large systems I
monitor the "in the wild" user count for Windows XP is still around 4%
of all users to the sites.

Same problem with RC4.  I'd love to lock that out too, but see above --
that means 4% of the users can't connect (at all.)

-- 
Karl Denninger
karl at denninger.net <mailto:karl at denninger.net>
/The Market Ticker/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2944 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://lists.freebsd.org/pipermail/freebsd-security/attachments/20150514/c1093fe3/attachment.bin>