title: Is the order of cipher names in TIdServerIOHandlerSSLOpenSSL.SSLOptions.CipherList important?
body: <p>I'm limiting the ciphers that my webservice allows to only these TLS 1.x ciphers:</p>
  
  <p><s>
      TLS_RSA_WITH_AES_128_CBC_SHA<br />
      TLS_RSA_WITH_AES_128_CBC_SHA256<br />
      TLS_RSA_WITH_AES_128_GCM_SHA256<br />
      TLS_RSA_WITH_AES_256_CBC_SHA<br />
      TLS_RSA_WITH_AES_256_CBC_SHA256<br />
      TLS_RSA_WITH_AES_256_GCM_SHA384<br />
      TLS_RSA_WITH_CAMELLIA_128_CBC_SHA<br />
      TLS_RSA_WITH_CAMELLIA_256_CBC_SHA<br />
      TLS_RSA_WITH_IDEA_CBC_SHA<br />
      TLS_RSA_WITH_RC4_128_MD5<br />
      TLS_RSA_WITH_RC4_128_SHA<br />
  </s></p>
  
  <p><strong>Update</strong> in response to <a href="https://stackoverflow.com/users/2868801/dave-thompson-085">Dave Thompson</a>'s comment:</p>
  
  <p>I now take the ciphers generated from <a href="https://security.stackexchange.com/a/77018/13695">this SO answer</a>, in that order.<br />
  Because we currently use Delphi XE2/Indy 10.5.8.0/OpenSSL 1.0.2f I leave out the ECDHE ciphers, these are <a href="https://stackoverflow.com/a/36146053/512728">too cumbersome to implement with these software versions</a>.<br />
  Also, we still allow TLS 1.0.<br />
  After the update to Delphi Seattle 10 we'll disallow TLS 1.0 and put the ECDHE ciphers back in.</p>
  
  <p>This leaves:</p>
  
  <pre><code>TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcc15)
  TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x9f)
  TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x9e)
  TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (0x6b)
  TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (0x67)
  TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 (0xc4)
  TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x39)
  TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x33)
  TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA (0x88)
  TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA (0x45)
  </code></pre>
  
  <p>Converted to OpenSSL names (according to <a href="https://testssl.sh/openssl-rfc.mappping.html" rel="nofollow noreferrer">Mapping OpenSSL cipher suite names to RFC names</a>) these are:</p>
  
  <pre><code>DHE-RSA-CHACHA20-POLY1305 
  DHE-RSA-AES256-GCM-SHA384 
  DHE-RSA-AES128-GCM-SHA256 
  DHE-RSA-AES256-SHA256 
  DHE-RSA-AES128-SHA256 
  - cannot find the equivalent for 0xc4 - anyone? -
  DHE-RSA-AES256-SHA
  DHE-RSA-AES128-SHA 
  DHE-RSA-CAMELLIA256-SHA 
  DHE-RSA-CAMELLIA128-SHA256
  </code></pre>
  
  <p>The order in which a server offers ciphers is important, but do I have control over this order? The CipherList is a string property containing these names concatenated with '+':</p>
  
  <pre><code>TIdServerIOHandlerSSLOpenSSL.SSLOptions.CipherList := 'DHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SH:DHE-RSA-AES128-SHA:DHE-RSA-CAMELLIA256-SHA:DHE-RSA-CAMELLIA128-SHA256';
  </code></pre>
  
  <p>If so, what is the recommended order?</p>
  
  <p>Note that, since my webservice is the server, I have set <code>SSLOptions.Mode := sslmServer</code>. </p>
  
  <p><s>* These are the ones that the <a href="http://nmap.org/" rel="nofollow noreferrer">nmap</a> script <a href="http://nmap.org/nsedoc/scripts/ssl-enum-ciphers.html" rel="nofollow noreferrer">ssl-enum-ciphers</a> grades with an 'A'</s></p>