Finally, the next ticket on Jira said “Disable RC4 from cipher suite”. It was time to bring back the A on the SSL Server Test result page which had recently been downgraded to a B.

Qualys SSL Server Test before HAProxy config update

For those who do not know, Qualys SSL Server Test is THE online SSL analyzer. To say it mildly, these guys knows SSL, with all it’s quarks and all! All you have to do is to type in a domain name and Qualys will start testing all kinds of aspects of the TLS connection.

So, what happened? Last time we checked we had an A- on your report card. Suddenly we had a B! To understand what happened we have to go back to 2011 where BEAST attack was disclosed. SSL Labs, and others, recrommended prioritizing the RC4 cipher:

The only reliable way to defend against BEAST is to priorities RC4 cipher suites.

Since this was the only option, we too configured our servers to priorities the RC4 cipher. Fast forward two years; RC4 now accounts for 50% of all TLS traffic, and then i happens. Researches find new weakneses in the already troubled RC4 cipher.

The attack on the RC4 cipher is still highly improbable, there aren’t any good workarounds either, that SSL Labs decides not to take any actions in their grading algorithm, until now recently.

Qualys SSL Server Test RC4 warning

Configuring HAProxy

When this change was noticed within your team we started researching how we could improve our score on SSL Labs. We quickly found the website, however their suggested cipher suite were too strict for us (sadly, we have to support IE > 7).

We then went to Mozilla which has an excellent article on recommended TLS configurations with different levels of security in mind. We choose the Intermediate compatibility (default) configuration:

For services that don’t need compatibility with legacy clients (mostly WinXP), but still need to support a wide range of clients, this configuration is recommended. It is is compatible with Firefox 1, Chrome 1, IE 7, Opera 5 and Safari 1.

This configuration disables SSLv3 and recommends key sizes of 2048 bits. With that in mind we ended up with the following HAProxy configuration:

  tune.ssl.default-dh-param 2048

  ssl-default-bind-options no-sslv3 no-tls-tickets

  ssl-default-server-options no-sslv3 no-tls-tickets


I am proud to announce that the Norwegian Trekking Association’s website again gets an A on Qualys SSL Server Test result page. All our trekking data is still belonging to us!

Qualys SSL Server Test after HAProxy config update

SSL can be intimidating and there is a lot of terminology to get familiar with. The certificate authority system is also a hairy mess to get used to. Thankfully we have tools to test and the knowledge to configure. Going forward we will add the SSL Server Test as one of our regular procedures in order to make sure we always follow best practices for securing TLS.


If you have any questions or other feedback to the article, please post them in the comment section bellow and I promise to read them and respond to you on a regular basis.