Mozilla SSL Configuration Generator

Re:Mozilla SSL Configuration Generator by jvehent on Friday April 10, 2015 @01:01PM (#9355622)

Hello HN, author of Server Side TLS [1] and co-maintainer of the conf generator here. Thanks for pushing this tool to the front page :) We've been improving our guidelines and this generator for the past year and a half, and while it in a pretty good shape, we always welcome comments and pull requests.

One comment that we get very often regards the ordering of the recommended ciphersuite. We've made some choices that are documented in [2] such as, for example, preferring AES 128 to 256 or maintaining compatibility with CAMELLIA and DES-CBC3-SHA in the intermediate configuration. The best place to discuss these choices is probably the `talk` section of the wiki page [3].

[1] https://wiki.mozilla.org/Security/Server_Side_TLS [2] https://wiki.mozilla.org/Security/Server_Side_TLS#Prioritiza... [3] https://wiki.mozilla.org/Talk:Security/Server_Side_TLS

[ Parent | on HN ]

Re:Mozilla SSL Configuration Generator by IgorPartola on Friday April 10, 2015 @01:07PM (#9355674)

Feature request: can openssl version and nginx version be dropdowns? For example, I know I'm on latest stable nginx, but I don't know what exact version number it is, and it's not obvious that the configuration will change if you update these values.

[ Parent | on HN ]

Re:Mozilla SSL Configuration Generator by gene_wood on Friday April 10, 2015 @01:15PM (#9355733)

@IgorPartola, sure thing (author of the conf generator here)! Go and and request it here ( https://github.com/mozilla/server-side-tls/issues ) and if you've got a lead on a canonical list of versions to work from that would help.

[ Parent | on HN ]

Re:Mozilla SSL Configuration Generator by qrmn on Friday April 10, 2015 @03:52PM (#9356740)

You can find a list of nginx's versions simply from the download directory: http://nginx.org/download/ - I know that much.

By the way... DSS? Is anyone anywhere using DSS certificates on the internet anymore? (And would they still be 1024-bit?) Let alone anyone who might actually read configuration advice? I didn't see any hosts presenting one last time I ran a survey, but I wouldn't swear to that being complete (maybe they only present it to certain clients?).

[ Parent | on HN ]

Re:Mozilla SSL Configuration Generator by jvehent on Friday April 10, 2015 @03:57PM (#9356769)

DSS will be removed in a future version of the ciphersuites. I believe support is being removed from Firefox too.

[ Parent | on HN ]

Re:Mozilla SSL Configuration Generator by jvehent on Friday April 10, 2015 @01:17PM (#9355741)

It's a tricky thing to do because of all the possible versions of all the possible web servers. The dropdown would end up being rather long, and require maintaining a list in the code. And then there's distribution specific backports, etc...

So we tabled this problem for now and went with a free field, but please do open a github issue and we'll add look for ways to do it.

[ Parent | on HN ]

Re:Mozilla SSL Configuration Generator by JohnTHaller on Friday April 10, 2015 @02:50PM (#9356352)

I'd suggest the dropdown re-populate based on the server selected and be based on the cutoffs you use for the different configurations it generates. So, if you select Apache, it'd give you something like 1.x, 2.1.0 - 2.2.x, 2.3.x, etc based on which versions share configurations.

[ Parent | on HN ]

Re:Mozilla SSL Configuration Generator by darklajid on Friday April 10, 2015 @01:37PM (#9355868)

Well, for the GP the 'feature' might be to allow a 'latest' version string already?

Keeping track of each released version is probably a huge pain in the .. back. But 'latest' (which isn't selected for openssl for me, for example: It shows 0.9.8.h atm) might already help to get the most fitting configuration for the current set of software?

I assume you don't care about individual releases _unless_ they change the configuration syntax/offer different cipher options?

[ Parent | on HN ]

Re:Mozilla SSL Configuration Generator by jvehent on Friday April 10, 2015 @01:41PM (#9355892)

That's a valid point. I'd suggest capturing it in the issue https://github.com/mozilla/server-side-tls/issues/39

There's a number of edge cases but we can probably find a middle ground that works well enough for the general case.

[ Parent | on HN ]

Re:Mozilla SSL Configuration Generator by ndboost on Friday April 10, 2015 @01:16PM (#9355735)

where can one submit bug reports for the generator.. is the code open sourced?

edit: i submitted issue #38 for a ui improvement. https://github.com/mozilla/server-side-tls/issues/38

[ Parent | on HN ]