MrPeterLambert
Re:Achieving a Perfect SSL Labs Score with Go
on Sunday May 22, 2016 @03:22PM (#11749864)
Can you explain how it isn't quite right? I would like to correct the article if this is the case.
When I ran the code, the Go HTTP/2 package caused a panic with the message "http2: TLSConfig.CipherSuites is missing HTTP/2-required TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256".
I went source diving and found the following:
https://golang.org/src/net/http/h2_bundle.go?h=TLS_ECDHE_RSA...
It even has the helpful comment:
> If they already provided a CipherSuite list, return an error if it has a bad order or is missing ECDHE_RSA_WITH_AES_128_GCM_SHA256.
I cannot see how I would have achieved my aim without disabling HTTP/2.
The aim of the exercise was to get a perfect score using Go. I wasn't discussing HTTP/2 in general. I was referencing the Go standard library implementation.
As I say, if you still think it's not right, please let me know.
Re:Achieving a Perfect SSL Labs Score with Go
on Sunday May 22, 2016 @09:27AM (#11748496)
Author here. This is exactly right.
I even go as far to say:
> You should probably stop here. Continuing to attempt to achieve a perfect score will result in reduced client compatibility. This means that many users will not be able to access your site.
I should probably have also said that it is unlikely to be their intentions. An A+ is more than good enough.
This was just an exercise to better understand how to influence the score with a Go server as I've read a few in the past for NGINX, Apache etc.
Aiming for 100% in all ares was just a fun, but mostly pointless metric. It did, however uncover a couple of interesting things along the way.