Comparison of SSL Labs TLS Scores with Different Go Versions

Re:Comparison of SSL Labs TLS Scores with Different Go Versions by selectnull on Wednesday February 03, 2016 @10:05AM (#11026784)

For those who might not be aware, the highest SSL Labs grade is not A, but A+.

To score A+ you must score A and additionally set HSTS headers with long duration (I use 2 years, haven't tried with less). For example, with Nginx you use something like:

    add_header Strict-Transport-Security "max-age=63113904;";

[ Parent | on HN ]

Re:Comparison of SSL Labs TLS Scores with Different Go Versions by tptacek on Wednesday February 03, 2016 @10:33AM (#11026954)

Right, and you can (and should) do this easily in Go, but it isn't a safe default.

[ Parent | on HN ]

Re:Comparison of SSL Labs TLS Scores with Different Go Versions by arca_vorago on Wednesday February 03, 2016 @11:03AM (#11027190)

If you use Hiawatha you get A+ with out of the box settings.

Just plugging it because it constantly outperforms my expectations and PolarSSL (now mbed owned by Arm), has avoided many of the recent openssl issues making my life less worrisome, but the dev doesn't really advertise or push it and relies on word of mouth more than anything.

It's worth checking out.

https://www.hiawatha-webserver.org

[ Parent | on HN ]

Re:Comparison of SSL Labs TLS Scores with Different Go Versions by tptacek on Wednesday February 03, 2016 @11:14AM (#11027271)

Zero is the number of TLS experts I know that would unreservedly recommend PolarSSL over Go's crypto/tls. I know several who wouldn't even recommend it over OpenSSL, but it's worth remembering that not only does Go's TLS not use OpenSSL, but it's curated by one of the world's experts in TLS security.

Go has one of the best TLS stacks in the world, and I expect the distinction to become starker in the future; in a few years, barring something unexpected from something like BoringSSL, it may end up being unquestioned best TLS stack.

[ Parent | on HN ]

Re:Comparison of SSL Labs TLS Scores with Different Go Versions by arca_vorago on Wednesday February 03, 2016 @03:10PM (#11029359)

Thanks for the info tptacek, do you have any reading along these lines that goes into any detail on this? From what I have been reading go tls is nice but computationally more intensive. I really like to go for the best wherever I can, so I am genuinely interested if anyone else has any input on this.

[ Parent | on HN ]

Re:Comparison of SSL Labs TLS Scores with Different Go Versions by faeron on Thursday February 04, 2016 @05:16AM (#11033023)

Go has one of the best TLS stacks in the world

Do you have any proof to support this claim?

[ Parent | on HN ]

Re:Comparison of SSL Labs TLS Scores with Different Go Versions by lazyjones on Wednesday February 03, 2016 @11:34AM (#11027392)

> Go has one of the best TLS stacks in the world,

Go suffers a bit from weak random numbers though (crypto/rand Read() output), says dieharder at least: http://nopaste.narf.at/show/31060/

I'm not sure how severe that is...

[ Parent | on HN ]

Re:Comparison of SSL Labs TLS Scores with Different Go Versions by tptacek on Wednesday February 03, 2016 @11:34AM (#11027397)

Horseshit. Go's crypto reads from urandom, just like Nacl.

[ Parent | on HN ]

Re:Comparison of SSL Labs TLS Scores with Different Go Versions by currysausage on Wednesday February 03, 2016 @05:56PM (#11030560)

> If you use Hiawatha you get A+ with out of the box settings.

Which means they set long HSTS by default, which will bite you quite badly if you're not ready yet for an irreversible HTTPS rollout. But yeah, A+ looks awesome on comparison tables, doesn't it?

[ Parent | on HN ]

Re:Comparison of SSL Labs TLS Scores with Different Go Versions by faeron on Thursday February 04, 2016 @05:00AM (#11032966)

No, it does not set a HSTS header by default. And the out of the box rating is A, not A+. However, with a simple setting you enable the HSTS header, which gives you the A+ rating.

[ Parent | on HN ]

Re:Comparison of SSL Labs TLS Scores with Different Go Versions by faeron on Thursday February 04, 2016 @05:11AM (#11033006)

The dev has tried to push it, but it seemed that nobody cares.

See https://www.hiawatha-webserver.org/forum/topic/2063/#10728

[ Parent | on HN ]