Cipher Suites
- Jase T. English
The Open Web Application Security Project® (OWASP) references Mozilla standards for its guidance on the the current cipher suites considered to be secure.
CUIT recommends that web server configurations be kept up-to-date with OWASP & Mozilla standards to best protect University applications. These cipher suites are available in a running document that can be found here:
https://ssl-config.mozilla.org/guidelines/latest.json
Note, the ciphers defined in the .json file above are considered up-to-date
TLS1.3: [configurations][modern][ciphersuites]
TLS1.2: [configurations][intermediate][ciphersuites]
If your web application needs the ciphers listed in a specific format, this information is specified in the document as well:
IANA: [configurations][intermediate][ciphersuites][iana]
OPENSSL: [configurations][intermediate][ciphers][openssl]
Ciphers in the following section SHOULD NOT BE USED (unless there is a legitimate business reason, which should be approved):
[configurations][old]
If you need assistance determining how to implement the correct acceptable ciphers, please reach out to cybersec@columbia.edu.