Add EDH-RSA-DES-CBC3-SHA to old and intermediate confs

1 files changed, 92 insertions, 44 deletions

diff --git a/Server_Side_TLS.mediawiki b/Server_Side_TLS.mediawiki
index 914f114..7efdc13 100644
--- a/Server_Side_TLS.mediawiki
+++ b/Server_Side_TLS.mediawiki
@@ -43,7 +43,7 @@ For services that don't need backward compatibility, the parameters below provid
 == <span style="color:orange;">'''Intermediate'''</span> compatibility (default) ==
 For services that don't need compatibility with legacy clients (mostly WinXP), but still need to support a wide range of clients, this configuration is recommended. It is is compatible with Firefox 1, Chrome 1, IE 7, Opera 5 and Safari 1.
 
-* Ciphersuite: '''ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA'''
+* Ciphersuite: '''ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA'''
 * Versions: '''TLSv1, TLSv1.1, TLSv1.2'''
 * RSA key size: '''2048'''
 * DH Parameter size: '''2048''' (see [[Security/Server_Side_TLS#DHE_and_Java|DHE and Java]] for details)
@@ -54,7 +54,7 @@ For services that don't need compatibility with legacy clients (mostly WinXP), b
 
 This is the old ciphersuite that works with all clients back to Windows XP/IE6. It should be used as a last resort only.
 
-* Ciphersuite: '''ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA'''
+* Ciphersuite: '''ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA'''
 * Versions: '''SSLv3, TLSv1, TLSv1.1, TLSv1.2'''
 * RSA key size: '''2048'''
 * DH Parameter size: '''1024''' (see [[#Pre-defined_DHE_groups|Pre-defined DHE groups]])
@@ -70,47 +70,95 @@ The listing below shows the list of algorithms returned by this ciphersuite. If
 Older versions of OpenSSL may not return the full list of algorithms. AES-GCM and some ECDHE are fairly recent, and not present on most versions of OpenSSL shipped with Ubuntu or RHEL. This listing below was obtained from a freshly built OpenSSL.
 
 <source lang="bash">
-$ openssl ciphers -V 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA'|column -t
-0xC0,0x2F  -  ECDHE-RSA-AES128-GCM-SHA256    TLSv1.2  Kx=ECDH  Au=RSA    Enc=AESGCM(128)    Mac=AEAD
-0xC0,0x2B  -  ECDHE-ECDSA-AES128-GCM-SHA256  TLSv1.2  Kx=ECDH  Au=ECDSA  Enc=AESGCM(128)    Mac=AEAD
-0xC0,0x30  -  ECDHE-RSA-AES256-GCM-SHA384    TLSv1.2  Kx=ECDH  Au=RSA    Enc=AESGCM(256)    Mac=AEAD
-0xC0,0x2C  -  ECDHE-ECDSA-AES256-GCM-SHA384  TLSv1.2  Kx=ECDH  Au=ECDSA  Enc=AESGCM(256)    Mac=AEAD
-0x00,0x9E  -  DHE-RSA-AES128-GCM-SHA256      TLSv1.2  Kx=DH    Au=RSA    Enc=AESGCM(128)    Mac=AEAD
-0x00,0xA2  -  DHE-DSS-AES128-GCM-SHA256      TLSv1.2  Kx=DH    Au=DSS    Enc=AESGCM(128)    Mac=AEAD
-0x00,0xA3  -  DHE-DSS-AES256-GCM-SHA384      TLSv1.2  Kx=DH    Au=DSS    Enc=AESGCM(256)    Mac=AEAD
-0x00,0x9F  -  DHE-RSA-AES256-GCM-SHA384      TLSv1.2  Kx=DH    Au=RSA    Enc=AESGCM(256)    Mac=AEAD
-0xC0,0x27  -  ECDHE-RSA-AES128-SHA256        TLSv1.2  Kx=ECDH  Au=RSA    Enc=AES(128)       Mac=SHA256
-0xC0,0x23  -  ECDHE-ECDSA-AES128-SHA256      TLSv1.2  Kx=ECDH  Au=ECDSA  Enc=AES(128)       Mac=SHA256
-0xC0,0x13  -  ECDHE-RSA-AES128-SHA           SSLv3    Kx=ECDH  Au=RSA    Enc=AES(128)       Mac=SHA1
-0xC0,0x09  -  ECDHE-ECDSA-AES128-SHA         SSLv3    Kx=ECDH  Au=ECDSA  Enc=AES(128)       Mac=SHA1
-0xC0,0x28  -  ECDHE-RSA-AES256-SHA384        TLSv1.2  Kx=ECDH  Au=RSA    Enc=AES(256)       Mac=SHA384
-0xC0,0x24  -  ECDHE-ECDSA-AES256-SHA384      TLSv1.2  Kx=ECDH  Au=ECDSA  Enc=AES(256)       Mac=SHA384
-0xC0,0x14  -  ECDHE-RSA-AES256-SHA           SSLv3    Kx=ECDH  Au=RSA    Enc=AES(256)       Mac=SHA1
-0xC0,0x0A  -  ECDHE-ECDSA-AES256-SHA         SSLv3    Kx=ECDH  Au=ECDSA  Enc=AES(256)       Mac=SHA1
-0x00,0x67  -  DHE-RSA-AES128-SHA256          TLSv1.2  Kx=DH    Au=RSA    Enc=AES(128)       Mac=SHA256
-0x00,0x33  -  DHE-RSA-AES128-SHA             SSLv3    Kx=DH    Au=RSA    Enc=AES(128)       Mac=SHA1
-0x00,0x40  -  DHE-DSS-AES128-SHA256          TLSv1.2  Kx=DH    Au=DSS    Enc=AES(128)       Mac=SHA256
-0x00,0x6B  -  DHE-RSA-AES256-SHA256          TLSv1.2  Kx=DH    Au=RSA    Enc=AES(256)       Mac=SHA256
-0x00,0x38  -  DHE-DSS-AES256-SHA             SSLv3    Kx=DH    Au=DSS    Enc=AES(256)       Mac=SHA1
-0x00,0x39  -  DHE-RSA-AES256-SHA             SSLv3    Kx=DH    Au=RSA    Enc=AES(256)       Mac=SHA1
-0xC0,0x12  -  ECDHE-RSA-DES-CBC3-SHA         SSLv3    Kx=ECDH  Au=RSA    Enc=3DES(168)      Mac=SHA1
-0xC0,0x08  -  ECDHE-ECDSA-DES-CBC3-SHA       SSLv3    Kx=ECDH  Au=ECDSA  Enc=3DES(168)      Mac=SHA1
-0x00,0x9C  -  AES128-GCM-SHA256              TLSv1.2  Kx=RSA   Au=RSA    Enc=AESGCM(128)    Mac=AEAD
-0x00,0x9D  -  AES256-GCM-SHA384              TLSv1.2  Kx=RSA   Au=RSA    Enc=AESGCM(256)    Mac=AEAD
-0x00,0x3C  -  AES128-SHA256                  TLSv1.2  Kx=RSA   Au=RSA    Enc=AES(128)       Mac=SHA256
-0x00,0x3D  -  AES256-SHA256                  TLSv1.2  Kx=RSA   Au=RSA    Enc=AES(256)       Mac=SHA256
-0x00,0x2F  -  AES128-SHA                     SSLv3    Kx=RSA   Au=RSA    Enc=AES(128)       Mac=SHA1
-0x00,0x35  -  AES256-SHA                     SSLv3    Kx=RSA   Au=RSA    Enc=AES(256)       Mac=SHA1
-0x00,0x6A  -  DHE-DSS-AES256-SHA256          TLSv1.2  Kx=DH    Au=DSS    Enc=AES(256)       Mac=SHA256
-0x00,0x32  -  DHE-DSS-AES128-SHA             SSLv3    Kx=DH    Au=DSS    Enc=AES(128)       Mac=SHA1
-0x00,0x0A  -  DES-CBC3-SHA                   SSLv3    Kx=RSA   Au=RSA    Enc=3DES(168)      Mac=SHA1
-0x00,0x88  -  DHE-RSA-CAMELLIA256-SHA        SSLv3    Kx=DH    Au=RSA    Enc=Camellia(256)  Mac=SHA1
-0x00,0x87  -  DHE-DSS-CAMELLIA256-SHA        SSLv3    Kx=DH    Au=DSS    Enc=Camellia(256)  Mac=SHA1
-0x00,0x84  -  CAMELLIA256-SHA                SSLv3    Kx=RSA   Au=RSA    Enc=Camellia(256)  Mac=SHA1
-0x00,0x45  -  DHE-RSA-CAMELLIA128-SHA        SSLv3    Kx=DH    Au=RSA    Enc=Camellia(128)  Mac=SHA1
-0x00,0x44  -  DHE-DSS-CAMELLIA128-SHA        SSLv3    Kx=DH    Au=DSS    Enc=Camellia(128)  Mac=SHA1
-0x00,0x41  -  CAMELLIA128-SHA                SSLv3    Kx=RSA   Au=RSA    Enc=Camellia(128)  Mac=SHA1
-
+$ openssl ciphers -V 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA'|column -t
+
+0xC0,0x2F  -  ECDHE-RSA-AES128-GCM-SHA256     TLSv1.2  Kx=ECDH    Au=RSA    Enc=AESGCM(128)    Mac=AEAD
+0xC0,0x2B  -  ECDHE-ECDSA-AES128-GCM-SHA256   TLSv1.2  Kx=ECDH    Au=ECDSA  Enc=AESGCM(128)    Mac=AEAD
+0xC0,0x30  -  ECDHE-RSA-AES256-GCM-SHA384     TLSv1.2  Kx=ECDH    Au=RSA    Enc=AESGCM(256)    Mac=AEAD
+0xC0,0x2C  -  ECDHE-ECDSA-AES256-GCM-SHA384   TLSv1.2  Kx=ECDH    Au=ECDSA  Enc=AESGCM(256)    Mac=AEAD
+0x00,0x9E  -  DHE-RSA-AES128-GCM-SHA256       TLSv1.2  Kx=DH      Au=RSA    Enc=AESGCM(128)    Mac=AEAD
+0x00,0xA2  -  DHE-DSS-AES128-GCM-SHA256       TLSv1.2  Kx=DH      Au=DSS    Enc=AESGCM(128)    Mac=AEAD
+0x00,0xA3  -  DHE-DSS-AES256-GCM-SHA384       TLSv1.2  Kx=DH      Au=DSS    Enc=AESGCM(256)    Mac=AEAD
+0x00,0x9F  -  DHE-RSA-AES256-GCM-SHA384       TLSv1.2  Kx=DH      Au=RSA    Enc=AESGCM(256)    Mac=AEAD
+0xC0,0x27  -  ECDHE-RSA-AES128-SHA256         TLSv1.2  Kx=ECDH    Au=RSA    Enc=AES(128)       Mac=SHA256
+0xC0,0x23  -  ECDHE-ECDSA-AES128-SHA256       TLSv1.2  Kx=ECDH    Au=ECDSA  Enc=AES(128)       Mac=SHA256
+0xC0,0x13  -  ECDHE-RSA-AES128-SHA            SSLv3    Kx=ECDH    Au=RSA    Enc=AES(128)       Mac=SHA1
+0xC0,0x09  -  ECDHE-ECDSA-AES128-SHA          SSLv3    Kx=ECDH    Au=ECDSA  Enc=AES(128)       Mac=SHA1
+0xC0,0x28  -  ECDHE-RSA-AES256-SHA384         TLSv1.2  Kx=ECDH    Au=RSA    Enc=AES(256)       Mac=SHA384
+0xC0,0x24  -  ECDHE-ECDSA-AES256-SHA384       TLSv1.2  Kx=ECDH    Au=ECDSA  Enc=AES(256)       Mac=SHA384
+0xC0,0x14  -  ECDHE-RSA-AES256-SHA            SSLv3    Kx=ECDH    Au=RSA    Enc=AES(256)       Mac=SHA1
+0xC0,0x0A  -  ECDHE-ECDSA-AES256-SHA          SSLv3    Kx=ECDH    Au=ECDSA  Enc=AES(256)       Mac=SHA1
+0x00,0x67  -  DHE-RSA-AES128-SHA256           TLSv1.2  Kx=DH      Au=RSA    Enc=AES(128)       Mac=SHA256
+0x00,0x33  -  DHE-RSA-AES128-SHA              SSLv3    Kx=DH      Au=RSA    Enc=AES(128)       Mac=SHA1
+0x00,0x40  -  DHE-DSS-AES128-SHA256           TLSv1.2  Kx=DH      Au=DSS    Enc=AES(128)       Mac=SHA256
+0x00,0x6B  -  DHE-RSA-AES256-SHA256           TLSv1.2  Kx=DH      Au=RSA    Enc=AES(256)       Mac=SHA256
+0x00,0x38  -  DHE-DSS-AES256-SHA              SSLv3    Kx=DH      Au=DSS    Enc=AES(256)       Mac=SHA1
+0x00,0x39  -  DHE-RSA-AES256-SHA              SSLv3    Kx=DH      Au=RSA    Enc=AES(256)       Mac=SHA1
+0xC0,0x12  -  ECDHE-RSA-DES-CBC3-SHA          SSLv3    Kx=ECDH    Au=RSA    Enc=3DES(168)      Mac=SHA1
+0xC0,0x08  -  ECDHE-ECDSA-DES-CBC3-SHA        SSLv3    Kx=ECDH    Au=ECDSA  Enc=3DES(168)      Mac=SHA1
+0x00,0x16  -  EDH-RSA-DES-CBC3-SHA            SSLv3    Kx=DH      Au=RSA    Enc=3DES(168)      Mac=SHA1
+0x00,0x9C  -  AES128-GCM-SHA256               TLSv1.2  Kx=RSA     Au=RSA    Enc=AESGCM(128)    Mac=AEAD
+0x00,0x9D  -  AES256-GCM-SHA384               TLSv1.2  Kx=RSA     Au=RSA    Enc=AESGCM(256)    Mac=AEAD
+0x00,0x3C  -  AES128-SHA256                   TLSv1.2  Kx=RSA     Au=RSA    Enc=AES(128)       Mac=SHA256
+0x00,0x3D  -  AES256-SHA256                   TLSv1.2  Kx=RSA     Au=RSA    Enc=AES(256)       Mac=SHA256
+0x00,0x2F  -  AES128-SHA                      SSLv3    Kx=RSA     Au=RSA    Enc=AES(128)       Mac=SHA1
+0x00,0x35  -  AES256-SHA                      SSLv3    Kx=RSA     Au=RSA    Enc=AES(256)       Mac=SHA1
+0xC0,0x22  -  SRP-DSS-AES-256-CBC-SHA         SSLv3    Kx=SRP     Au=DSS    Enc=AES(256)       Mac=SHA1
+0xC0,0x21  -  SRP-RSA-AES-256-CBC-SHA         SSLv3    Kx=SRP     Au=RSA    Enc=AES(256)       Mac=SHA1
+0xC0,0x20  -  SRP-AES-256-CBC-SHA             SSLv3    Kx=SRP     Au=SRP    Enc=AES(256)       Mac=SHA1
+0x00,0xA5  -  DH-DSS-AES256-GCM-SHA384        TLSv1.2  Kx=DH/DSS  Au=DH     Enc=AESGCM(256)    Mac=AEAD
+0x00,0xA1  -  DH-RSA-AES256-GCM-SHA384        TLSv1.2  Kx=DH/RSA  Au=DH     Enc=AESGCM(256)    Mac=AEAD
+0x00,0x6A  -  DHE-DSS-AES256-SHA256           TLSv1.2  Kx=DH      Au=DSS    Enc=AES(256)       Mac=SHA256
+0x00,0x69  -  DH-RSA-AES256-SHA256            TLSv1.2  Kx=DH/RSA  Au=DH     Enc=AES(256)       Mac=SHA256
+0x00,0x68  -  DH-DSS-AES256-SHA256            TLSv1.2  Kx=DH/DSS  Au=DH     Enc=AES(256)       Mac=SHA256
+0x00,0x37  -  DH-RSA-AES256-SHA               SSLv3    Kx=DH/RSA  Au=DH     Enc=AES(256)       Mac=SHA1
+0x00,0x36  -  DH-DSS-AES256-SHA               SSLv3    Kx=DH/DSS  Au=DH     Enc=AES(256)       Mac=SHA1
+0x00,0x95  -  RSA-PSK-AES256-CBC-SHA          SSLv3    Kx=RSAPSK  Au=RSA    Enc=AES(256)       Mac=SHA1
+0xC0,0x1F  -  SRP-DSS-AES-128-CBC-SHA         SSLv3    Kx=SRP     Au=DSS    Enc=AES(128)       Mac=SHA1
+0xC0,0x1E  -  SRP-RSA-AES-128-CBC-SHA         SSLv3    Kx=SRP     Au=RSA    Enc=AES(128)       Mac=SHA1
+0xC0,0x1D  -  SRP-AES-128-CBC-SHA             SSLv3    Kx=SRP     Au=SRP    Enc=AES(128)       Mac=SHA1
+0x00,0xA4  -  DH-DSS-AES128-GCM-SHA256        TLSv1.2  Kx=DH/DSS  Au=DH     Enc=AESGCM(128)    Mac=AEAD
+0x00,0xA0  -  DH-RSA-AES128-GCM-SHA256        TLSv1.2  Kx=DH/RSA  Au=DH     Enc=AESGCM(128)    Mac=AEAD
+0x00,0x3F  -  DH-RSA-AES128-SHA256            TLSv1.2  Kx=DH/RSA  Au=DH     Enc=AES(128)       Mac=SHA256
+0x00,0x3E  -  DH-DSS-AES128-SHA256            TLSv1.2  Kx=DH/DSS  Au=DH     Enc=AES(128)       Mac=SHA256
+0x00,0x32  -  DHE-DSS-AES128-SHA              SSLv3    Kx=DH      Au=DSS    Enc=AES(128)       Mac=SHA1
+0x00,0x31  -  DH-RSA-AES128-SHA               SSLv3    Kx=DH/RSA  Au=DH     Enc=AES(128)       Mac=SHA1
+0x00,0x30  -  DH-DSS-AES128-SHA               SSLv3    Kx=DH/DSS  Au=DH     Enc=AES(128)       Mac=SHA1
+0x00,0x94  -  RSA-PSK-AES128-CBC-SHA          SSLv3    Kx=RSAPSK  Au=RSA    Enc=AES(128)       Mac=SHA1
+0x00,0x0A  -  DES-CBC3-SHA                    SSLv3    Kx=RSA     Au=RSA    Enc=3DES(168)      Mac=SHA1
+0xCC,0x14  -  ECDHE-ECDSA-CHACHA20-POLY1305   TLSv1.2  Kx=ECDH    Au=ECDSA  Enc=ChaCha20(256)  Mac=AEAD
+0xCC,0x13  -  ECDHE-RSA-CHACHA20-POLY1305     TLSv1.2  Kx=ECDH    Au=RSA    Enc=ChaCha20(256)  Mac=AEAD
+0xCC,0x15  -  DHE-RSA-CHACHA20-POLY1305       TLSv1.2  Kx=DH      Au=RSA    Enc=ChaCha20(256)  Mac=AEAD
+0xC0,0x77  -  ECDHE-RSA-CAMELLIA256-SHA384    TLSv1.2  Kx=ECDH    Au=RSA    Enc=Camellia(256)  Mac=SHA384
+0xC0,0x73  -  ECDHE-ECDSA-CAMELLIA256-SHA384  TLSv1.2  Kx=ECDH    Au=ECDSA  Enc=Camellia(256)  Mac=SHA384
+0x00,0xC4  -  DHE-RSA-CAMELLIA256-SHA256      TLSv1.2  Kx=DH      Au=RSA    Enc=Camellia(256)  Mac=SHA256
+0x00,0xC3  -  DHE-DSS-CAMELLIA256-SHA256      TLSv1.2  Kx=DH      Au=DSS    Enc=Camellia(256)  Mac=SHA256
+0x00,0xC2  -  DH-RSA-CAMELLIA256-SHA256       TLSv1.2  Kx=DH/RSA  Au=DH     Enc=Camellia(256)  Mac=SHA256
+0x00,0xC1  -  DH-DSS-CAMELLIA256-SHA256       TLSv1.2  Kx=DH/DSS  Au=DH     Enc=Camellia(256)  Mac=SHA256
+0x00,0x88  -  DHE-RSA-CAMELLIA256-SHA         SSLv3    Kx=DH      Au=RSA    Enc=Camellia(256)  Mac=SHA1
+0x00,0x87  -  DHE-DSS-CAMELLIA256-SHA         SSLv3    Kx=DH      Au=DSS    Enc=Camellia(256)  Mac=SHA1
+0x00,0x86  -  DH-RSA-CAMELLIA256-SHA          SSLv3    Kx=DH/RSA  Au=DH     Enc=Camellia(256)  Mac=SHA1
+0x00,0x85  -  DH-DSS-CAMELLIA256-SHA          SSLv3    Kx=DH/DSS  Au=DH     Enc=Camellia(256)  Mac=SHA1
+0x00,0xC0  -  CAMELLIA256-SHA256              TLSv1.2  Kx=RSA     Au=RSA    Enc=Camellia(256)  Mac=SHA256
+0x00,0x84  -  CAMELLIA256-SHA                 SSLv3    Kx=RSA     Au=RSA    Enc=Camellia(256)  Mac=SHA1
+0xC0,0x76  -  ECDHE-RSA-CAMELLIA128-SHA256    TLSv1.2  Kx=ECDH    Au=RSA    Enc=Camellia(128)  Mac=SHA256
+0xC0,0x72  -  ECDHE-ECDSA-CAMELLIA128-SHA256  TLSv1.2  Kx=ECDH    Au=ECDSA  Enc=Camellia(128)  Mac=SHA256
+0x00,0xBE  -  DHE-RSA-CAMELLIA128-SHA256      TLSv1.2  Kx=DH      Au=RSA    Enc=Camellia(128)  Mac=SHA256
+0x00,0xBD  -  DHE-DSS-CAMELLIA128-SHA256      TLSv1.2  Kx=DH      Au=DSS    Enc=Camellia(128)  Mac=SHA256
+0x00,0xBC  -  DH-RSA-CAMELLIA128-SHA256       TLSv1.2  Kx=DH/RSA  Au=DH     Enc=Camellia(128)  Mac=SHA256
+0x00,0xBB  -  DH-DSS-CAMELLIA128-SHA256       TLSv1.2  Kx=DH/DSS  Au=DH     Enc=Camellia(128)  Mac=SHA256
+0x00,0x45  -  DHE-RSA-CAMELLIA128-SHA         SSLv3    Kx=DH      Au=RSA    Enc=Camellia(128)  Mac=SHA1
+0x00,0x44  -  DHE-DSS-CAMELLIA128-SHA         SSLv3    Kx=DH      Au=DSS    Enc=Camellia(128)  Mac=SHA1
+0x00,0x43  -  DH-RSA-CAMELLIA128-SHA          SSLv3    Kx=DH/RSA  Au=DH     Enc=Camellia(128)  Mac=SHA1
+0x00,0x42  -  DH-DSS-CAMELLIA128-SHA          SSLv3    Kx=DH/DSS  Au=DH     Enc=Camellia(128)  Mac=SHA1
+0x00,0xBA  -  CAMELLIA128-SHA256              TLSv1.2  Kx=RSA     Au=RSA    Enc=Camellia(128)  Mac=SHA256
+0x00,0x41  -  CAMELLIA128-SHA                 SSLv3    Kx=RSA     Au=RSA    Enc=Camellia(128)  Mac=SHA1
+0xC0,0x1C  -  SRP-DSS-3DES-EDE-CBC-SHA        SSLv3    Kx=SRP     Au=DSS    Enc=3DES(168)      Mac=SHA1
+0xC0,0x1B  -  SRP-RSA-3DES-EDE-CBC-SHA        SSLv3    Kx=SRP     Au=RSA    Enc=3DES(168)      Mac=SHA1
+0xC0,0x1A  -  SRP-3DES-EDE-CBC-SHA            SSLv3    Kx=SRP     Au=SRP    Enc=3DES(168)      Mac=SHA1
+0x00,0x10  -  DH-RSA-DES-CBC3-SHA             SSLv3    Kx=DH/RSA  Au=DH     Enc=3DES(168)      Mac=SHA1
+0x00,0x0D  -  DH-DSS-DES-CBC3-SHA             SSLv3    Kx=DH/DSS  Au=DH     Enc=3DES(168)      Mac=SHA1
+0x00,0x93  -  RSA-PSK-3DES-EDE-CBC-SHA        SSLv3    Kx=RSAPSK  Au=RSA    Enc=3DES(168)      Mac=SHA1
 </source>
 
 The ciphers are described here: http://www.openssl.org/docs/apps/ciphers.html
@@ -121,7 +169,7 @@ The ciphers are described here: http://www.openssl.org/docs/apps/ciphers.html
 # [[#Forward_Secrecy|PFS]] ciphersuites are preferred, with ECDHE first, then DHE.
 # SHA256 signature is preferred to SHA-1 in ciphers and certificates. MD5 is disallowed entirely.
 # AES 128 is preferred to AES 256. There has been [http://www.mail-archive.com/dev-tech-crypto@lists.mozilla.org/msg11247.html discussions] on whether AES256 extra security was worth the cost, and the result is far from obvious. At the moment, AES128 is preferred, because it provides good security, is really fast, and seems to be more resistant to timing attacks.
-# In the backward compatible ciphersuite, AES is preferred to 3DES. [[#Attacks_on_TLS|BEAST]] attacks on AES are mitigated in TLS 1.1 and above, and difficult to achieve in TLS 1.0. In the non-backward compatible ciphersuite, 3DES is not present.
+# In the backward compatible ciphersuite, AES is preferred to 3DES. [[#Attacks_on_TLS|BEAST]] attacks on AES are mitigated in TLS 1.1 and above, and difficult to achieve in TLS 1.0. In the modern configuration, 3DES is not present.
 # RC4 is removed entirely. 3DES is used for backward compatibility. See discussion in [[#RC4_weaknesses]]
 
 = Mandatory discards =