better cipher list

mojolicious · Jul 3, 2013 · 45c5fb7 · 45c5fb7
1 parent a9f23e5
commit 45c5fb7
Showing 1 changed file with 3 additions and 12 deletions.
diff --git a/lib/Mojo/IOLoop/Server.pm b/lib/Mojo/IOLoop/Server.pm
@@ -25,17 +25,6 @@ use constant TLS_WRITE => TLS ? IO::Socket::SSL::SSL_WANT_WRITE() : 0;
 my $CERT = catfile dirname(__FILE__), 'server.crt';
 my $KEY  = catfile dirname(__FILE__), 'server.key';
 
-# Prioritize RC4 to mitigate BEAST attack, use Perfect Forward Secrecy and
-# disable SSLv2
-my $CIPHERS = join ':',
-  qw(!SSLv2 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-GCM-SHA384),
-  qw(ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES256-SHA384),
-  qw(ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-GCM-SHA256),
-  qw(ECDHE-ECDSA-AES128-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-ECDSA-RC4-SHA),
-  qw(ECDHE-RSA-RC4-SHA ECDH-ECDSA-RC4-SHA ECDH-RSA-RC4-SHA),
-  qw(ECDHE-RSA-AES256-SHA RC4-SHA HIGH !aNULL !eNULL !LOW !3DES !MD5 !EXP),
-  qw(!CBC !EDH !kEDH !PSK !SRP !kECDH);
-
 has multi_accept => 50;
 has reactor      => sub {
   require Mojo::IOLoop;
@@ -92,9 +81,11 @@ sub listen {
   return unless $args->{tls};
   croak "IO::Socket::SSL 1.75 required for TLS support" unless TLS;
 
+  # Prioritize RC4 to mitigate BEAST attack and use Perfect Forward Secrecy
   my $options = $self->{tls} = {
     SSL_cert_file => $args->{tls_cert} || $CERT,
-    SSL_cipher_list        => $CIPHERS,
+    SSL_cipher_list =>
+      'ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH',
     SSL_honor_cipher_order => 1,
     SSL_key_file           => $args->{tls_key} || $KEY,
     SSL_startHandshake     => 0,