Sign Up ›

Browse by Topic
ShowAll Questionssorted byDate Posted
+ Start a Discussion
nvishnvish 

https using AES

Does salesforce support the use of AES instead of RC4 https encrpyion for the web front ends? How easy is it to switch?

ygluckygluck

Salesforce servers support a few strong encryption ciphers. Here is the current list as you can see from ssllabs.com:

 

Cipher Suites (SSLv3+ suites in server-preferred order, then SSLv2 suites where used)

TLS_RSA_WITH_RC4_128_MD5 (0x4)

128

 

TLS_RSA_WITH_RC4_128_SHA (0x5)

128

 

TLS_RSA_WITH_AES_128_CBC_SHA (0x2f)

128

 

TLS_RSA_WITH_AES_256_CBC_SHA (0x35)

256

 

TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa)

168

 

TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x33)   DH 1024 bits (p: 128, g: 1, Ys: 128)

128

 

TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x39)   DH 1024 bits (p: 128, g: 1, Ys: 128)

256

 

TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA (0x16)   DH 1024 bits (p: 128, g: 1, Ys: 128)

168

 

 

If you prefer to not use RC4, you can configure your browser to not accept that cipher.

 

Yoel Gluck

Product Security Team @ Salesforce.com