Configuring extended settings

You can delete filter entries to approve cipher suites, and you can define additional filters with the help of Regular Expressions. The syntax follows the syntax of java/util/regex/pattern.

See: http://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html.

A period represents any character, and an asterisk represents any number of characters. The specifically provided cipher suites are determined by the Java version and can be viewed in the Possible TLS/SSL Parameter on Server section for the server if the COM server or DMZ proxy is running and available.

Then the existing classes are continuously separated according to the second Sort Order Class. If all criteria, that is lines, have been considered, you can continue with the next class. This procedure is used until you reach the last Sort Order Class. Finally the ciphers from the classes are packed into a list in the order according to the classes and subclasses. The new ciphers of future Java versions are thus considered automatically. The sorting criteria are entered as a list of Regexp expressions. See Sort TLS/SSL Cipher Suite inside this class. The syntax corresponds to the one of the TLS/SSL Cipher Suite Filter. Modifications are immediately displayed in Possible TLS/SSL Parameter on Server, if the COM server or the DMZ proxy are running.

Click Plus to add a new Sort Order Class. Use the arrows to modify the class order. You can delete classes by clicking Recycle. Click Enter to insert new criteria (lines) within a class. Use the arrows to change the order of the criteria. You can delete criteria (lines) by clicking Delete.

Sorting example:

Class 1: 
.*(_DHE_|_ECDHE_).* 
// Cipher with DHE and ECDHE, i.e. ciphers with Perfect Forward Secrecy first. 

Class 2: 
.*_AES_512_.* 
.*_AES_256_.* 
.*_AES_128_.* 
.*_3DES_.* 
// Prefer Ciphers with symmetrical AES encryption. The long keys are preferred to the short ones. 

Class 3: 
.*_SHA512 
.*_SHA384 
.*_SHA256 
.*_SHA 
// Prefer ciphers with big signature hash values. 

Class 4: 
.*_GCM_.* 
// Prefer ciphers with block cipher modus GCM to those with CBC modus. 

Class 5: 
.*_ECDHE_.* 
// Prefer ciphers with elliptic curve to those with RSA (within class 1!)