I would love a -secure flag to just use the most secure option of the current version of the software even at the cost of X years of backward compatibility at the tool/client/browser level.
For example for nginx instead of something like:
ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS;
ssl_ciphers SECURE;> ssl_ciphers SECURE;
That's actually pretty close to nginx's default (unpatched) config (http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_c...), except openssl calls it HIGH.
ssl_ciphers HIGH:!aNULL:!MD5;
How high HIGH is depends on your version of openssl, ie, you probably don't want it for, say RHEL 5's openssl. Which (openssl has a long lifecycle, LTS Linux distros extend it further) some places may still be using.
https://www.openssl.org/docs/manmaster/apps/ciphers.html
A better implementation of the same concept is Mozilla's SSL Config Generator (which is what CertSimple point customers to - we also maintain the node port): it has Modern/Intermediate/Old with a clear idea of the compatibility you're losing with each: https://mozilla.github.io/server-side-tls/ssl-config-generat...
Right now it feels like trying to fly a B747.
There's the Mozilla SSL Configuration Generator which helps with the madness, but they still aren't keeping up with the latest recommendations.
I just set up a site a few days ago with caddy - http://caddyserver.com. Getting certs for multiple domains was a matter of adding a single line for tls to the config, it generates a key locally, requests the cert, and installs it transparently on the first request. Pretty smooth. I hope they will autorenew without intervention, haven't tested that bit yet, but so far it was painless.
I imagine most mainstream servers will incorporate this sort of smooth tls flow at some point now that services like letsencrypt are available to base it on. I'm considering moving web server for other sites (usually use nginx) for this single feature.
It was exposed in a conference at "pas sage en seine 2015"[1] that almost every french banks websites use broken security because their ATMs are still running windows XP and go through the same web server.
We as an organisation like to take our time. We wouldn't welcome a new joiner with a PC on his desk. Much more fun to see him struggling for weeks with our internal IT approval processes. We happily pay millions to Microsoft to get the privilege of using Windows Xp / 32 bit systems a little bit longer (I have now almost more RAM in my mobile phone than my workstation). In fact I suspect many of the critical infrastructures of the organisation are running on COBOL. We'd probably still use CRT screens if our IT department could source them. We are certainly still using blackberries (I hope they will stash enough devices before RIM goes bust).
I am surprised complexity of setting up SSL isn't mentioned in the article.
First the tools are complex to use, use various formats for storing keys that are incompatible. In Linux you pretty much have to rely on cryptic command lines. Windows is slightly simpler. And you need more tools to convert certificates between the different formats (for instance using an IIS certificate with FileZilla).
Then you have to deal with the complexity of the algorithms used, the fact that chrome won't accept sha1 anymore, the fact that http2 is very picky in the cryptographic methods used.
What is a best practice today breaks tomorrow. For instance the following script written only a couple of years ago shows how to set up windows to get an A on SSLLabs:
https://www.hass.de/content/setup-your-iis-ssl-perfect-forwa...
But with IIS10 / http2, this list of ciphers is incompatible with chrome. I found a list that works here:
https://code.google.com/p/chromium/issues/detail?id=529994
but I am sure it will break older browsers.
Etc, etc, etc. This is hard work. Until setting up SSL will be a simple box to tick in IIS or a single setting to change in apache, only developers who really care about security and are really motivated will deal with this shit.