re: Ciphers on IBM HTTP Server

[<jododu@xxxxxxx>]

From: 
http://publib-b.boulder.ibm.com/Redbooks.nsf/RedbookAbstracts/tips0284.html?Open

The CipherSuiteList directive of the HTTP Server (original) was just one 
directive with all supported ciphers specified from left (preferred) to right. 
For the HTTP Server (powered by Apache), you have to add one SSLCipherSpec 
directive per cipher suite from top (preferred) to bottom.

The problem is that Microsoft's Internet Explorer?s (IE) 56-bit SSL 
implementation has flaws in that it prevents it from negotiating with servers 
that use a higher encryption than it does, unless you disable a few ciphers on 
the server side. This bug was released with IE Version 5, and the only fix that 
Microsoft has is to install 128-bit encryption. To circumvent this problem in 
the HTTP Server (original) configuration you can use this directive:

CipherSuiteList 0405090A0306

For the equivalent configuration, you would specify in your HTTP Server 
(powered by Apache) configuration file:

SSLCipherSpec SSL_RSA_WITH_RC4_128_MD5
SSLCipherSpec SSL_RSA_WITH_RC4_128_SHA
SSLCipherSpec SSL_RSA_WITH_DES_CBC_SHA
SSLCipherSpec SSL_RSA_WITH_3DES_EDE_CBC_SHA
SSLCipherSpec SSL_RSA_EXPORT_WITH_RC4_40_MD5
SSLCipherSpec SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5

Attention: The third line SSLCipherSpec SSL_RSA_WITH_DES_CBC_SHA indicates use 
DES with 56-bit encryption. The four line SSLCipherSpec 
SSL_RSA_WITH_3DES_EDE_CBC_SHA indicates use 3DES with 168-bit encryption. Why 
would somebody want a weaker cipher to be chosen before the stronger one? To 
solve a problem with an older browser. You must be careful to not "oversell" to 
your clients the strength of your encryption on your site if you make these 
types of server-side configuration changes.