Re: Use Mozilla's intermediate cipher suites set by default.

Nick Lowe wrote:

Alan and Arran,

Please may I suggest that you consider changing the default cipher suites configuration in FreeRADIUS 2.x and 3.x to use Mozilla's intermediate compatibility (default) set to encourage the use of better cipher suites that use ECDHE, GCM and PFS?

See https://wiki.mozilla.org/Security/Server_Side_TLS

Except that also disables the PSK cipher suites, which we absolutely require. And we want to disable all SSLv3 cipher suites, because EAP uses TLSv1 or later. I am VERY wary of changing the list of cipher suites. I'd be happier with forbidding certain ones. Alan DeKok.