Forward Secrecy

If you're new to Forward Secrecy, please read the following links first:

• SSL Labs: Deploying Forward Secrecy first.
• SSL/TLS & Perfect Forward Secrecy

Requirements

To deploy Forward Secrecy, you need to have both your web server and the underlying SSL/TLS library that support the necessary suites. For example:

• OpenSSL 1.0.1e
• Apache 2.4.x
• nginx 1.0.6+ and 1.1.0+

Assuming these requirements are satisfied, you can enable Forward Secrecy in two steps:

1. Configure the web server to actively select suites
2. Configure the OpenSSL suite string

Configuring OpenSSL

$ openssl ciphers -V 'EECDH+AESGCM:EECDH+SHA256:EECDH+aRSA+SHA384:EECDH+RC4:EDH+aRSA:EECDH !aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP'