{"action":"created","issue":{"url":"https://api.github.com/repos/iojs/io.js/issues/818","labels_url":"https://api.github.com/repos/iojs/io.js/issues/818/labels{/name}","comments_url":"https://api.github.com/repos/iojs/io.js/issues/818/comments","events_url":"https://api.github.com/repos/iojs/io.js/issues/818/events","html_url":"https://github.com/iojs/io.js/issues/818","id":57460559,"number":818,"title":"Perfect Forward Secrecy: Default ciphers and Chrome","user":{"login":"jorangreef","id":413206,"avatar_url":"https://avatars.githubusercontent.com/u/413206?v=3","gravatar_id":"","url":"https://api.github.com/users/jorangreef","html_url":"https://github.com/jorangreef","followers_url":"https://api.github.com/users/jorangreef/followers","following_url":"https://api.github.com/users/jorangreef/following{/other_user}","gists_url":"https://api.github.com/users/jorangreef/gists{/gist_id}","starred_url":"https://api.github.com/users/jorangreef/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jorangreef/subscriptions","organizations_url":"https://api.github.com/users/jorangreef/orgs","repos_url":"https://api.github.com/users/jorangreef/repos","events_url":"https://api.github.com/users/jorangreef/events{/privacy}","received_events_url":"https://api.github.com/users/jorangreef/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-02-12T13:34:50Z","updated_at":"2015-02-12T20:39:26Z","closed_at":null,"body":"I assumed that with the right OpenSSL and with default ciphers, that a connection from Chrome would negotiate using ECDHE.\r\n\r\nThe default ciphers are: ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL\r\n\r\nBut I think that with those Chrome settles for AES128-GCM-SHA256, see: https://www.ssllabs.com/ssltest/viewClient.html?name=Chrome&version=39&platform=OS%20X.\r\n\r\nAdding ECDHE-RSA-AES128-GCM-SHA256 to the default ciphers list would fix this.\r\n\r\nI don't know if this is an issue or not, but I think it would be great if io.js servers supported perfect forward secrecy on most major browsers out of the box."},"comment":{"url":"https://api.github.com/repos/iojs/io.js/issues/comments/74148157","html_url":"https://github.com/iojs/io.js/issues/818#issuecomment-74148157","issue_url":"https://api.github.com/repos/iojs/io.js/issues/818","id":74148157,"user":{"login":"silverwind","id":115237,"avatar_url":"https://avatars.githubusercontent.com/u/115237?v=3","gravatar_id":"","url":"https://api.github.com/users/silverwind","html_url":"https://github.com/silverwind","followers_url":"https://api.github.com/users/silverwind/followers","following_url":"https://api.github.com/users/silverwind/following{/other_user}","gists_url":"https://api.github.com/users/silverwind/gists{/gist_id}","starred_url":"https://api.github.com/users/silverwind/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/silverwind/subscriptions","organizations_url":"https://api.github.com/users/silverwind/orgs","repos_url":"https://api.github.com/users/silverwind/repos","events_url":"https://api.github.com/users/silverwind/events{/privacy}","received_events_url":"https://api.github.com/users/silverwind/received_events","type":"User","site_admin":false},"created_at":"2015-02-12T20:39:26Z","updated_at":"2015-02-12T20:39:26Z","body":"@jorangreef did you by chance test with `honorCipherOrder` enabled? My tests show that Chrome negotiates ECDHE fine without it, but with it set, I get the RSA cipher as seen above."}}