Does cipher name order in TIdServerIOHandlerSSLOpenSSL.SSLOptions.CipherList ?
Mostly yes.
TLS does not determine who decides on the cipher. Typically, the server prefers client preferences. That is, the server will use the first client preference if it is available and enabled, or the second client preference if it is available and enabled, etc.
Most libraries allow the server to override behavior. For example, with the OpenSSL option, SSL_OP_CIPHER_SERVER_PREFERENCE . In this case, the server will correspond to the first preference of the server if the client declares it, the second version of the server if the client declares it, etc.
For the servers I manage, I set up a list of cipher suites and usually set SSL_OP_CIPHER_SERVER_PREFERENCE because many clients do not pay attention to details. They just throw soup from the cipher suites at ClientHello, hoping something sticks.
The order in which the server offers ciphers is important, but can I control this order?
Yes.
On the server, determine your order of the cipher suites, and then set them using SSL_CTX_set_cipher_list or SSL_set_cipher_list . By setting the list, you will be convinced that RC4-MD5 not used even for his first choice of client (assuming that you omit it). For maximum impact, also set the context parameter SSL_OP_CIPHER_SERVER_PREFERENCE .
Also see How to disable a specific cipher suite in openssl? The context is OpenSSL, but it should give you an idea of where to go in Delphi.
(Comments): Which is not clear to me from your answer: Does the CipherList property already mean an order? If I look at the Delphi / Indy base code, I see that it is just a wrapper for the external function SSL_CTX_set_cipher_list : function(_para1: PSSL_CTX; const str: PAnsiChar): TIdC_INT cdecl = nil; in IdSSLOpenSSLHeaders.pas SSL_CTX_set_cipher_list : function(_para1: PSSL_CTX; const str: PAnsiChar): TIdC_INT cdecl = nil; in IdSSLOpenSSLHeaders.pas
If I understand Delphi correctly, then I believe the answer is Yes, it is. But it probably uses either (1) the default OpenSSL list, or (2) the default Delphi list. Both of them are probably similar to "ALL:!EXP:!LOW" or similar. In any case, you will want to customize it to your taste.
If you are interested in what the list looks like when it is wired, use Wireshark to check ClientHello. It is easy to generate with s_client , and it shows you what the list of default OpenSSL cipher packages looks like:
$ openssl s_client -connect www.ietf.org:443 -tls1 -servername www.ietf.org
And the corresponding Wireshark route with 55 standard encryption sets packed into it:
You can also improve the security situation and reduce the number of cipher suites with the -cipher and "HIGH:!aNULL:!MD5:!RC4" . The number of encrypted sets will be reduced to about 35.
$ openssl s_client -connect www.ietf.org:443 -tls1 -servername www.ietf.org \ -cipher 'HIGH:!aNULL:!MD5:!RC4'
If you don't like TripleDES and Cameilla, you can reduce them to 20 cipher suites with:
$ openssl s_client -connect www.ietf.org:443 -tls1 -servername www.ietf.org \ -cipher 'HIGH:!aNULL:!MD5:!RC4:!3DES:!CAMELLIA'
Now suppose that the client is configured only with RC4-MD5 , and the server is configured only with AES-GCM . Ie, there is no intersection of cipher suites between client and server. In this case, you will receive an error message in OpenSSL. The error will be 0x1408A0C1, "there are no common cipher suites." On the server, it will look something like this:
140339533272744:error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher:s3_srvr.c:1353
For clients and servers based on OpenSSL, you can define a list of default encryption packages with the line "DEFAULT". This is literally what it was called (check out the ciphers(1) man page ).
There are 103 of them, which include weak and wounded algorithms. In practice, you want to connect it to 16 or so cipher suites that you prefer to use (that is, your security position):
$ openssl ciphers -v 'DEFAULT' | cut -f 1 -d " " | wc -l 103
and
$ openssl ciphers -v 'DEFAULT' | cut -f 1 -d " " ECDHE-RSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-ECDSA-AES256-SHA SRP-DSS-AES-256-CBC-SHA SRP-RSA-AES-256-CBC-SHA SRP-AES-256-CBC-SHA DH-DSS-AES256-GCM-SHA384 DHE-DSS-AES256-GCM-SHA384 DH-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-SHA256 DHE-DSS-AES256-SHA256 DH-RSA-AES256-SHA256 DH-DSS-AES256-SHA256 DHE-RSA-AES256-SHA DHE-DSS-AES256-SHA DH-RSA-AES256-SHA DH-DSS-AES256-SHA DHE-RSA-CAMELLIA256-SHA DHE-DSS-CAMELLIA256-SHA DH-RSA-CAMELLIA256-SHA DH-DSS-CAMELLIA256-SHA ECDH-RSA-AES256-GCM-SHA384 ECDH-ECDSA-AES256-GCM-SHA384 ECDH-RSA-AES256-SHA384 ECDH-ECDSA-AES256-SHA384 ECDH-RSA-AES256-SHA ECDH-ECDSA-AES256-SHA AES256-GCM-SHA384 AES256-SHA256 AES256-SHA CAMELLIA256-SHA PSK-AES256-CBC-SHA ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-ECDSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-ECDSA-AES128-SHA SRP-DSS-AES-128-CBC-SHA SRP-RSA-AES-128-CBC-SHA SRP-AES-128-CBC-SHA DH-DSS-AES128-GCM-SHA256 DHE-DSS-AES128-GCM-SHA256 DH-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-SHA256 DHE-DSS-AES128-SHA256 DH-RSA-AES128-SHA256 DH-DSS-AES128-SHA256 DHE-RSA-AES128-SHA DHE-DSS-AES128-SHA DH-RSA-AES128-SHA DH-DSS-AES128-SHA DHE-RSA-SEED-SHA DHE-DSS-SEED-SHA DH-RSA-SEED-SHA DH-DSS-SEED-SHA DHE-RSA-CAMELLIA128-SHA DHE-DSS-CAMELLIA128-SHA DH-RSA-CAMELLIA128-SHA DH-DSS-CAMELLIA128-SHA ECDH-RSA-AES128-GCM-SHA256 ECDH-ECDSA-AES128-GCM-SHA256 ECDH-RSA-AES128-SHA256 ECDH-ECDSA-AES128-SHA256 ECDH-RSA-AES128-SHA ECDH-ECDSA-AES128-SHA AES128-GCM-SHA256 AES128-SHA256 AES128-SHA SEED-SHA CAMELLIA128-SHA IDEA-CBC-SHA PSK-AES128-CBC-SHA ECDHE-RSA-RC4-SHA ECDHE-ECDSA-RC4-SHA ECDH-RSA-RC4-SHA ECDH-ECDSA-RC4-SHA RC4-SHA RC4-MD5 PSK-RC4-SHA ECDHE-RSA-DES-CBC3-SHA ECDHE-ECDSA-DES-CBC3-SHA SRP-DSS-3DES-EDE-CBC-SHA SRP-RSA-3DES-EDE-CBC-SHA SRP-3DES-EDE-CBC-SHA EDH-RSA-DES-CBC3-SHA EDH-DSS-DES-CBC3-SHA DH-RSA-DES-CBC3-SHA DH-DSS-DES-CBC3-SHA ECDH-RSA-DES-CBC3-SHA ECDH-ECDSA-DES-CBC3-SHA DES-CBC3-SHA PSK-3DES-EDE-CBC-SHA EDH-RSA-DES-CBC-SHA EDH-DSS-DES-CBC-SHA DH-RSA-DES-CBC-SHA DH-DSS-DES-CBC-SHA DES-CBC-SHA