undefined | Better HN

0 pointstombrossman12y ago0 comments

Thanks for writing this post, I've bookmarked it for reading later as it has plenty of links and I can see I have a lot more reading to do.

If you edit or update your post, I hope you will Mozilla's excellent "Security/Server Side TLS" page at https://wiki.mozilla.org/Security/Server_Side_TLS. This helped me get up to speed quickly and provided clear examples.

As proof of how good the Mozilla docs are, I tested my personal website using the Qualys test you mention and received an A+ rating!

This beat the A- rating for your site (though I freely admit I'm a total noob in this area - I'm copy/pasting and don't understand much about SSL). I guess this reinforces your point that good documentation is critical, and I hope more people find it at the Mozilla site.

https://www.ssllabs.com/ssltest/analyze.html?d=tombrossman.c...

https://www.ssllabs.com/ssltest/analyze.html?d=daniel.molken...

0 comments

4 comments · 2 top-level

jvehent12y ago· 1 in thread

Author of the Mozilla's Server Side TLS here. Glad that you found it helpful. Anything else that you think we should add to it?

danimo12y ago

Second-to-best solutions with older Distributions (Ubuntu 12.04, Debian 7, RHEL 6).

danimo12y ago· 1 in thread

That's an excellent reference with good explanations. I'll add it to the list to get away from the strong Ivan bias :-). The reason why I had A- only is that my openssl (Debian) doesn't seem provide all the ciphers required.

puetzk12y ago

It's probably your apache, actually; 2.2 can't do ECDHE, even though the openssl in Debian 7 can.

Sadly, this means IE doesn't get forward secrecy, because it can't do do DHE with RSA keys, only DSS.

j / k navigate · click thread line to collapse