249
FLASH
MEDIA
SERVER
4.5
CONFIGURATION
AND
ADMINISTRATION
XML configuration files reference
Last updated 11/28/2012
SSLCipherSuite
Specifies the suite of encryption ciphers that the server uses to secure communications.
This element is a colon-delimited list of encryption resources, such as a key-exchange algorithm, authentication
method, encryption method, digest type, or one of a selected number of aliases for common groupings. Each item in
the cipher list specifies the inclusion or exclusion of an algorithm or cipher. In addition, there are special keywords and
prefixes. For example, the keyword
ALL
specifies all ciphers, and the prefix
!
removes the cipher from the list.
The default cipher list instructs the server to accept all ciphers, but block those using anonymous Diffie-Hellman
authentication, block low-strength ciphers, block export ciphers, block MD5 hashing, and sort ciphers by strength
from highest to lowest level of encryption.
Important:
Contact Adobe Support before changing the default settings.
The cipher list consists of one or more cipher strings separated by colons. Commas or spaces are also acceptable
separators, but colons are normally used.
The string of ciphers can take several different forms.
•
It can consist of a single cipher suite, such as RC4-SHA.
•
It can represent a list of cipher suites containing a certain algorithm, or cipher suites of a certain type.
For example,
SHA1
represents all cipher suites using the digest algorithm SHA1, and
SSLv3
represents all SSL v3
algorithms.
•
Lists of cipher suites can be combined in a single cipher string using the
+
character as a logical
and
operation.
For example,
SHA1+DES
represents all cipher suites containing the
SHA1
and
DES
algorithms.
•
Each cipher string can be optionally preceded by the characters
!
,
-
, or
+
.
•
If
!
is used, then the ciphers are permanently deleted from the list. The ciphers deleted can never reappear in the
list even if they are explicitly stated.
•
If
-
is used, then the ciphers are deleted from the list, but some or all of the ciphers can be added again later.
•
If
+
is used, then the ciphers are moved to the end of the list. This option doesn't add any new ciphers—it just moves
matching existing ones.
•
If none of these characters is present, then the string is just interpreted as a list of ciphers to be appended to the
current preference list.
•
If the list includes any ciphers already present, the server does not evaluate them.
•
The cipher string
@STRENGTH
sorts the current cipher list in order of the length of the encryption algorithm key.
The components can be combined with the appropriate prefixes to create a list of ciphers, including only those ciphers
the server is prepared to accept, in the order of preference.
Example
This cipher string instructs the server to accept all ciphers except those using anonymous or ephemeral Diffie-Hellman
key exchange.
<SSLCipherSuite>ALL:!ADH:!EDH</SSLCipherSuite>
These cipher strings instruct the server to accept only RSA key exchange and refuse export or null encryption. The
server evaluates both strings as equivalent.
<SSLCipherSuite>RSA:!NULL!EXP</SSLCipherSuite>
<SSLCipherSuite>RSA:LOW:MEDIUM:HIGH</SSLCipherSuite>