Re:Fighting Cargo Cult – An Incomplete SSL/TLS Bookmark Coll...
by jvehent on Monday April 21, 2014 @01:32PM
(#7622341)
Author of the Mozilla's Server Side TLS here. Glad that you found it helpful. Anything else that you think we should add to it?
Re:Fighting Cargo Cult – An Incomplete SSL/TLS Bookmark Coll...
by danimo on Monday April 21, 2014 @02:29PM
(#7622714)
Second-to-best solutions with older Distributions (Ubuntu 12.04, Debian 7, RHEL 6).
Re:Fighting Cargo Cult – An Incomplete SSL/TLS Bookmark Coll...
by danimo on Monday April 21, 2014 @10:28AM
(#7621188)
That's an excellent reference with good explanations. I'll add it to the list to get away from the strong Ivan bias :-). The reason why I had A- only is that my openssl (Debian) doesn't seem provide all the ciphers required.
Re:Fighting Cargo Cult – An Incomplete SSL/TLS Bookmark Coll...
by puetzk on Wednesday April 23, 2014 @10:13PM
(#7638159)
It's probably your apache, actually; 2.2 can't do ECDHE, even though the openssl in Debian 7 can.
Sadly, this means IE doesn't get forward secrecy, because it can't do do DHE with RSA keys, only DSS.
If you edit or update your post, I hope you will Mozilla's excellent "Security/Server Side TLS" page at https://wiki.mozilla.org/Security/Server_Side_TLS. This helped me get up to speed quickly and provided clear examples.
As proof of how good the Mozilla docs are, I tested my personal website using the Qualys test you mention and received an A+ rating!
This beat the A- rating for your site (though I freely admit I'm a total noob in this area - I'm copy/pasting and don't understand much about SSL). I guess this reinforces your point that good documentation is critical, and I hope more people find it at the Mozilla site.
https://www.ssllabs.com/ssltest/analyze.html?d=tombrossman.c...
https://www.ssllabs.com/ssltest/analyze.html?d=daniel.molken...