4

I maintain a website for the government, which is http only. The target audience is all civilian, so the browser client may be very old down to IE6.

Recently they request to upgrade the site to https. I scratch my hair that don't know what protocol and cipher suits should I use.

refer to Mozilla recommendations, is the "Old backward compatibility" right for us?

If the reader using most modern version of browser, is the security level lower than "Intermediate compatibility (default)" or "Modern compatibility"?

  • Isn't there some sort of government protocol? – Steve Feb 6 '17 at 11:32
5

Given some inherent security issues with SSL it tends to be best to disable SSLv3 and lower and stick to TLS 1.0+ however if there is a high chance of substantially old browsers connecting that only support SSL3 then the only real choice is to enable SSL3 as well. This really is something better checked with your government's IT services department to check what the regulatory and organisational requirements are within your government.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy