Re: [gentoo-server] TLS over SSL?

[David Mallwitz]

Zhang Weiwu wrote:
> I think I have to give up only using TLS, but use SSL instead. Most of
> my visitors to my site are using Internet Explorer, but I just tried and
> found (by surprise) Internet Explorer 6 by default does not allow TLS
> connection. The users must go to Internet Options -> Advanced -> Enable
> TLS 1.0 connection. I know well my visitors are too stupid to do this,
> and in Internet Cafe people have no access to Internet Options.
>
> But why? Why IE6 choose not to use TLS by default? Are they really
> stupid or something?

The client and the server negotiate to find a common method to encrypt 
communications. If TLS is available to both then there is a possibility 
that it will be used. However, most browsers/email clients/whatever come 
with the least restrictive set of ciphers and methods enabled, for 
backwards compatability. So you may find that you have your site set up 
properly but the client will end up using 40 bit SSLv2, even though it 
is totally insecure these days (to be technical, it was busted from the 
get go). Check out the mod_ssl modules in your 
/etc/apache/conf/modules.d directory for more details on what you can do 
to provide high quality encryption service to your customers.

Dave