glpi-neural-brain/data/research-evidence/fb7bf2d0fd9ae21e1fb7b3cb.json

{
  "schema_version": 1,
  "saved_at": "2026-08-07T04:15:11.4083062Z",
  "content_sha256": "128b47dcbf6f91df07ddb2ecc3c83e2397eab91ab3e6916362459070e8c353a5",
  "result": {
    "title": "Enabling Perfect Forward Secrecy",
    "url": "https://knowledge.digicert.com/tutorials/enabling-perfect-forward-secrecy",
    "snippet": "This page provides instructions on how to configure Apache and Nginx for Perfect Forward Secrecy.",
    "content": "Enabling Perfect Forward Secrecy\n\nKnowledge Base\n\nEnabling Perfect Forward Secrecy\n\nSolution ID : TL88\n\nLast Modified : 04/14/2026\n\nClick to copy\n\nTo encrypt communications between you and your end users, you purchase a SSL Certificate, install it on your server, and then configure your website to use the certificate to protect these communications. The SSL connection begins when the end user’s browser reaches out to shake hands with your website.\n\nDuring this handshake, information regarding the ability of the browser and server are exchanged, validation occurs, and a session key that meets both the browser’s and server’s criteria is created. Once the session key is created, the rest of the conversation between the end user and your site is encrypted and thus secured. Historically, the most common method for negotiating the session key involved the RSA public-key cryptosystem. The RSA approach uses the server’s public key to protect the session key parameters created by the browser once they are sent the server. The server is able to decrypt this handshake with its corresponding private key.\n\nWhen you use the RSA key exchange mechanism, it creates a link between the server’s key pair and the session key created for each unique secure session. Thus, if an attacker is ever able to get hold of the server’s private key, they can decrypt your SSL session and any saved SSL sessions.\n\nIn contrast, when you enable Perfect Forward Secrecy (PFS), there is no link between your server’s private key and each session key. If an attacker ever gets access to your server’s private key, the attacker cannot use the private key to decrypt any of your archived sessions, which is why it is called “Perfect Forward Secrecy”.\n\nTo see if your server supports Perfect Forward Secrecy, use  Discovery  to test it.\n\nDeploying Perfect Forward Secrecy\n\nInstead of using the RSA method for exchanging session keys, you should use the Elliptic Curve Diffie-Hellman (ECDHE) key exchange. Note that you can still use the RSA public-key cryptosystem as the encryption algorithm, just not as the key exchange algorithm. ECDHE is much faster than ordinary DH (Diffie-Hellman), but both create session keys that only the entities involved in the SSL connection can access. Because the session keys are not linked to the server’s key pair, the server’s private key alone cannot be used to decrypt any SSL session.\n\nTo enable Perfect Forward Secrecy, you must do the following:\n\nReorder your cipher suites to place the ECDHE (Elliptic Curve Diffie-Hellman) suites at the top of list, followed by the DHE (Diffie-Hellman) suites.\n\nConfigure servers to enable other non-DH-key-exchange cipher suites from the list of cipher suites offered by the SSL Client.\n\nConfiguring Perfect Forward Secrecy\n\nConfiguring Apache for Perfect Forward Secrecy\n\nConfiguring Nginx for Perfect Forward Secrecy\n\nConfiguring Apache for Forward Secrecy\n\nBefore you configure your Apache server for Forward Secrecy, your web server and SSL/TLS library should support Elliptic Curve cryptography (ECC).\n\nMinimum Required Versions\n\nOpenSSL 1.0.1c+\n\nApache 2.4x\n\nNote :   Because of the Heartbleed bug and OpenSSL vulnerabilities, you should update to the most recent versions (i.e. OpenSSL version 1.0.1h).\n\nHow to Configure Apache for Forward Secrecy\n\nTo configure Apache for Forward Secrecy, you configure the server to actively choose cipher suites and then activate the right OpenSSL cipher suite configuration string.\n\nLocate your SSL Protocol Configuration on your Apache server.\n\nFor example,\n\nType the following command:\n\ngrep -i -r \"SSLEngine\" /etc/apache\n\nIn this example,  /etc/apache  is the base directory for the Apache installation.\n\nThe command will out put the available Virtual Hosts.\n\nOpen the Virtual Host for which you are enabling Forward Secrecy.\n\nAdd the following lines to your configuration:\n\nSSLProtocol all -SSLv2 -SSLv3\n\nSSLHonorCipherOrder on\n\nFor  SSLCipherSuite , use one of the following configurations:\n\nConfigure with RC4\n\nUse this configuration if you have a preference for GCM (Galois Counter Mode) suites (these suites are resistant to timing attacks) and RC4 (RC4 is resistant to BEAST). To improve performance, use the faster ECDHE suites whenever possible.\n\nSSLCipherSuite \"EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS\"\n\nConfigure without RC4\n\nUse this configuration if you have a preference for GCM (Galois Counter Mode) suites (these suites are resistant to timing attacks) and you prefer not to use RC4. To improve performance, use the faster ECDHE suites whenever possible.\n\nSSLCipherSuite \"EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4\"\n\nConfigure with RC4 as a last resort to support wide range and older browsers\n\nUse this configuration if you have a preference for GCM (Galois Counter Mode) suites (these suites are resistant to timing attacks) and you want to use RC4 only as a last resort in order to support a wide range of browsers and/or older browsers. To improve performance, use the faster ECDHE suites whenever possible.\n\nSSLCipherSuite \"EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS +RC4 RC4\"\n\nRestart Apache.\n\nFor example, type the following command:\n\napachectl -k restart\n\nTo verify that you have enabled Forward Secrecy, use  Discovery  to test your configuration.\n\nYou have successfully configured Apache for Forward Secrecy.\n\nConfiguring Nginx for Forward Secrecy\n\nBefore you configure your Nginx server for Forward Secrecy, your web server and SSL/TLS library should support Elliptic Curve cryptography (ECC).\n\nMinimum Required Versions\n\nOpenSSL 1.0.1c+\n\nNginx 1.0.6+ and 1.1.0+\n\nNote :  Because of the Heartbleed bug and OpenSSL vulnerabilities, you should update to the most recent versions (i.e. OpenSSL version 1.0.1h).\n\nHow to Configure Nginx for Forward Secrecy\n\nTo configure Nginx for Forward Secrecy, you configure the server to actively choose cipher suites and then activate the right OpenSSL cipher suite configuration string.\n\nLocate your SSL Protocol Configuration on your Nginx server.\n\nFor example,\n\nType the following command:\n\ngrep -r ssl_protocol /etc/nginx\n\nIn this example,  /etc/nginx  is the base directory for the Nginx installation.\n\nThe command will out put the available Server Blocks.\n\nOpen the Server Block for which you are enabling Forward Secrecy.\n\nAdd the following lines to your configuration:\n\nssl_protocols TLSv1.2 TLSv1.1 TLSv1;\n\nssl_prefer_server_ciphers on;\n\nFor  ssl_ciphers , use one of the following configurations:\n\nConfigure with RC4\n\nUse this configuration if you have a preference for GCM (Galois Counter Mode) suites (these suites are resistant to timing attacks) and RC4 (RC4 is resistant to BEAST). To improve performance, use the faster ECDHE suites whenever possible.\n\nssl_ciphers \"EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS\";\n\nConfigure without RC4\n\nUse this configuration if you have a preference for GCM (Galois Counter Mode) suites (these suites are resistant to timing attacks) and you prefer not to use RC4. To improve performance, use the faster ECDHE suites whenever possible.\n\nssl_ciphers \"EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4\";\n\nConfigure with RC4 as a last resort to support wide range and older browsers\n\nUse this configuration if you have a preference for GCM (Galois Counter Mode) suites (these suites are resistant to timing attacks) and you want to use RC4 only as a last resort in order to support a wide range of browsers and/or older browsers. To improve performance, use the faster ECDHE suites whenever possible.\n\nssl_ciphers \"EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS +RC4 RC4\";\n\nRestart Nginx.\n\nFor example, type the following command:\n\nsudo service nginx restart\n\nTo verify that you have enabled Forward Secrecy, use  Discovery  to test your configuration.\n\nYou have successfully configured Nginx for Forward Secrecy.\n\nDid you find this page helpful?\n\n👍 👎\n\nWe're glad this helped!\n\nWhat did you like most about your experience today?\n\nWe're sorry this wasn't helpful.\n\nWhich of the following would best describe the issue you faced?\n\nInformation was missing Steps were unclear or confusing Couldn't find what I needed Other\n\nYour feedback is important to us. Please share more about your experience.\n\nSkip Done\n\nThank you for your feedback!\n\nThe most-trusted global provider of high-assurance TLS/SSL, PKI, IoT and signing solutions.\n\nSupport\n\nTLS/SSL Support\n\nPKI Support\n\nSSL Checker\n\nCertificate Utility\n\nGenerate CSR\n\nReport Certificate Misuse\n\nProducts\n\nCompare Certificates\n\nTLS/SSL Certificates\n\nPro TLS/SSL Certificates\n\nMulti-Domain SSL\n\nWildcard Certificates\n\nDocument Signing\n\nCode Signing\n\nSolutions\n\nCertCentral\n\nDigiCert® Trust Lifecycle Manager\n\nDigiCert® Device Trust Manager\n\nDigiCert® Software Trust Manager\n\nDigiCert® Content Trust Manager\n\nSolutions Overview\n\nDigiCert ONE\n\n© 2022-2026, DigiCert, Inc. All rights reserved.\n\nCookie Settings\n\nTO TOP",
    "content_type": "text/html",
    "query": "Wie wird Perfect Forward Secrecy in TLS konfiguriert?",
    "language": "de-DE",
    "round": 1,
    "fetched": true,
    "relevant": true,
    "relevance": 0.9542857142857143,
    "source_quality": "reputable_secondary",
    "source_quality_score": 0.8240000000000001,
    "actionable": true,
    "covered_gap_ids": [
      "G1"
    ],
    "assessment_reason": "Wiederverwendete semantisch äquivalente Recherche: Die Quelle beschreibt die Konfiguration von Perfect Forward Secrecy in Apache und Nginx und gibt konkrete Anweisungen zur Reihenfolge der Cipher Suites sowie zur Konfiguration der Server. Sie ist direkt relevant und enthält umsetzbare Schritte."
  }
}