Why not by default? Ask ubuntu and report a bug: https://bugs.launchpad.net/ubun...

prg318 · on June 25, 2013

I think your first link may be incorrect? I also tried looking through the tracker but I wasn't able to find a relevant bug associated with this. Would you mind posting the link to the bug?

jcampbell1 · on June 25, 2013

The second link doesn't work as far as I can tell.

I think the person that says we need Apache 2.4 to get ECDHE is correct. Adding ECDHE ciphers to the Apache 2.2 config doesn't seem to do anything. Following the advice in the second link actually turns off PFS for chrome compared to the default setup.

dfc · on June 25, 2013

I have a bad habit of linking to HN posts and assuming that people understand I mean "look at the comments." The Cloudflare instructions break chrome? That is my bad, I have not verified them myself recently. I usually use the cloudflare settings or jacob's duraconf[1]. Thanks to joeyh's mr I usually have duraconf checked out on any machine that I use.

[1] https://github.com/ioerror/duraconf

jcampbell1 · on June 26, 2013

Yes, the cloudflare advice does break chrome PFS. With the defaults, chrome shows:

    CAMELLIA_256_CBC, with SHA1 for message 
    authentication and DHE_RSA as the 
    key exchange mechanism.

By changing to the suggestion in the comments, the encryption downgrades to:

    The connection is encrypted using RC4_128,
    with SHA1 for message authentication and 
    RSA as the key exchange mechanism.

dfc · on June 26, 2013

Yeah, I actually just noticed that cloudflare was using nginx so the qualys scan was not indicative of the cloudflare apache setup. I apologize I got distracted watching those genetic cars.

newman314 · on June 26, 2013

See my comment in the second link for what I use for nginx. I prefer explicitly stating ciphers to make sure only the ones I want presented are used

dfc · on June 25, 2013

I am sorry, my link was correct but the context was incorrect. The link is to submit a new bug for apache in ubuntu's bug tracker. I changed the text so that it is clear that I am suggesting that a bug be filed.

In my opinion pubic issue trackers are one of the greatest features of open source software and under utilized. Since there are no open or closed bugs I imagine the most likely answer for why it is not on by default is "nobody asked or not enough people asked." If enough people say "this applies to me" on a bug in launchpad the maintainers will recognize that it is an important feature for users. If there is a reason why it is not on by default the WONTFIX bug report will provide an answer for other people who are curious.