Re:Cipherli.st – Strong Ciphers for Apache, Nginx and Lighttpd
by AdamJacobMuller on Saturday May 07, 2016 @04:14AM
(#11648819)
One of the things I noticed was that there is no rationale listed for the ssl_session_tickets disablement.
I assume your concern is something like https://www.imperialviolet.org/2013/06/27/botchingpfs.html which for most general use cases you're correct in saying that it should be disabled, but, it definitely deserves a nuanced explanation.
Re:Cipherli.st – Strong Ciphers for Apache, Nginx and Lighttpd
by vtlynch on Friday May 06, 2016 @04:30PM
(#11646520)
How often are the recommendations on cipherli.st updated?
Re:Cipherli.st – Strong Ciphers for Apache, Nginx and Lighttpd
by mdewinter on Saturday May 07, 2016 @03:01AM
(#11648686)
Not very often, mostly when someone sends a merge request with a new piece of software (like varnish).
I'm also behind other projects like an SSL (site) test, a fast one: https://ssldecoder.org/ and a certificate monitoring service (reminds you before expiring): https://certificatemonitor.org/.
Also my personal site describing my adventures in *NIX and cloudland: https://raymii.org/s/, plus a boatload of TLS related articles.
The mozilla guide is also very good, the ability to configure based on your server settings and browser support is a heck of a nice feature. Whenever I have time to learn javascript that's the first thing to implement.
Although, all my projects are open source (https://github.com/RaymiiOrg/) so merge requests are welcome. Ferm GPL believer here.