apply suggestions from review

Author: renetapopova

modules/ROOT/pages/backup-restore/online-backup.adoc

@@ -309,8 +309,9 @@ For more information on how to configure SSL in Neo4j, see xref:security/ssl-fra
 
 Configuration for the backup server should be added to the _neo4j.conf_ file and configuration for backup client to the _neo4j-admin.conf_ file.
 The easiest way to ensure compatibility is to use the same SSL policy configuration for both the server and the client.
-However, this approach is not recommended for production environments, where it is better to use Certificate Authorities (CAs) to sign the certificates used by both the server and the client.
-For details, see xref:security/ssl-framework.adoc[SSL framework].
+For production environments, it is recommended to use Certificate Authorities (CAs) to sign certificates rather than self-signed certificates.
+
+
 
 The default backup port is 6362, configured with key `server.backup.listen_address`.
 The SSL configuration policy has the key of `dbms.ssl.policy.backup`.
@@ -323,7 +324,7 @@ As an example, add the following content to your _neo4j.conf_ and _neo4j-admin.c
 dbms.ssl.policy.backup.enabled=true
 dbms.ssl.policy.backup.client_auth=REQUIRE
 dbms.ssl.policy.backup.tls_versions=TLSv1.2,TLSv1.3
-dbms.ssl.policy.backup.ciphers=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
+dbms.ssl.policy.backup.ciphers=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
 ----
 
 .Client configuration in _neo4j-admin.conf_
@@ -332,7 +333,7 @@ dbms.ssl.policy.backup.ciphers=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE
 dbms.ssl.policy.backup.enabled=true
 dbms.ssl.policy.backup.client_auth=REQUIRE
 dbms.ssl.policy.backup.tls_versions=TLSv1.2,TLSv1.3
-dbms.ssl.policy.backup.ciphers=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
+dbms.ssl.policy.backup.ciphers=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
 ----
 
 [TIP]

modules/ROOT/pages/security/ssl-framework.adoc

@@ -846,15 +846,21 @@ However, if your backup communication uses a different port, you need to enable
 
 When setting up SSL for backup communication, you can choose between two options for certificates:
 
-* self-signed certificates -- This is typically the case where the system is fully internal (not internet-facing), you control both ends of the connection, and the distribution of certificates can be automated and secured.
-* certificates signed by a certificate authority (CA) -- This is typically the case where at least one end of the connection is internet-facing, and you want to use certificates signed by a trusted CA to avoid security flaws associated with self-signed certificates.
+* self-signed certificates -- This is typically the case where you control both ends of the connection, and the distribution of certificates can be automated and secured.
+However, self-signed certificates do not verify the identity of the server, so they cannot be trusted by clients and are vulnerable to man-in-the-middle attacks.
+* certificates signed by a certificate authority (CA) -- more secure option, because a known trusted authority verifies the identity of the server, ensuring authenticity and preventing impersonation.
 
-There are three possible approaches to set up SSL for backup communication:
 
-* Use the same self-signed certificates in the _trusted_dir_ on both the backup server and client.
-* Mirror the self-signed certificates if you want mutual TLS.
-This means, the server has the client's certificates in its _trusted_dir_, and the client has the server's certificates in its _trusted_dir_.
-* Use a certificate authority (CA) to signs both the client's and server's certificates.
+You can configure SSL for backup communication in one of the following ways:
+
+* Use the same certificates in the _trusted_dir_ on both the backup server and client. +
+This approach is simpler to configure but less secure, as both ends share the same identity and trust the same certificate.
+
+* Mirror the certificates on the backup server and client to achieve mutual authentication. +
+Add the server certificate to the client's _trusted_dir_ and the client certificate to the server's _trusted_dir_.
+This way, the server validates the client's certificate in addition to the typical normal TLS where only the client validates the server's certificate.
+
+* Use a certificate authority (CA) to sign both the client's and server's certificates.
 In this case, the _trusted_dir_ must contain only the CA or intermediate certificates.
 
 ==== Set up SSL certificates for backup
@@ -1014,7 +1020,7 @@ dbms.ssl.policy.backup.private_key=private.key
 dbms.ssl.policy.backup.public_certificate=public.crt
 dbms.ssl.policy.backup.client_auth=REQUIRE
 dbms.ssl.policy.backup.tls_versions=TLSv1.2,TLSv1.3
-dbms.ssl.policy.backup.ciphers=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
+dbms.ssl.policy.backup.ciphers=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
 ----
 
 [[ssl-other-configs]]
@@ -1112,25 +1118,25 @@ However, you still can use them by explicitly specifying their configuration and
 .Bolt
 [source, properties]
 ----
-dbms.ssl.policy.bolt.ciphers=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
+dbms.ssl.policy.bolt.ciphers=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA3844
 ----
 
 .HTTPS
 [source, properties]
 ----
-dbms.ssl.policy.https.ciphers=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
+dbms.ssl.policy.https.ciphers=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA3844
 ----
 
 .Intra-cluster encryption
 [source, properties]
 ----
-dbms.ssl.policy.cluster.ciphers=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
+dbms.ssl.policy.cluster.ciphers=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA3844
 ----
 
 .Backup
 [source, properties]
 ----
-dbms.ssl.policy.backup.ciphers=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
+dbms.ssl.policy.backup.ciphers=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA3844
 ----
 
 [[ssl-ocsp-config]]