| View previous topic :: View next topic |
| Author |
Message |
Steffen
Moderator
Joined: 14 Oct 2005
Posts: 1193
Location: Hilversum, NL, EU
|
 Posted: Tue 13 Jul '10 19:18 Post subject: Test Your SSL Server Now! SSL Labs |
 |
|
Ivan Ristic (mod_security author) has a fantastic tool on his site to test your SSL configuration.
Go to http://www.ssllabs.com , at the bottom enter your domain name for a detailed security assessment of your SSL server.
Steffen |
|
| Back to top |
|
James Blond
Moderator
Joined: 19 Jan 2006
Posts: 2813
Location: Germany, Next to Hamburg
|
| Posted: Tue 13 Jul '10 20:12 Post subject: |
|
|
I made that test. It tells me that I use insecure SSL 2.0. How can I turn that off in httpd.conf? Yepp I'm to lazy for RTFM  |
|
| Back to top |
|
glsmith
Moderator
Joined: 16 Oct 2007
Posts: 849
Location: Close enough to Baja to empty the cupboards
|
| Posted: Tue 13 Jul '10 20:20 Post subject: |
|
|
SSLProtocol all -SSLv2
Edit:
Actually, if you are speaking of this one:
SSL 2.0+ Upgrade Support
The only way to remove it is to disable sslv3 as well.
SSLProtocol +TLSv1
Doing that and removing DES cipher during my new OSSL build, I have been able to achieve a overall score of 90.
My first score was a 76, second (DES removed) was 85, now a 90. I wonder what clients are around that are not compatible with this setup. Should I even care becomes the next question.
This test is a Kobayashi Maru as it seems impossible to get a 100 today cause as far as I know TLS/1.2 is nothing more than theory at this time. TLS1.1 will be in OSSL 1.0.1 IIRC, that still leaves the server unable to get a 100.
Edit 2:
Doing this actually changed the PCI Complaint flag from No to Yes
Last edited by glsmith on Wed 14 Jul '10 1:05; edited 1 time in total |
|
| Back to top |
|
James Blond
Moderator
Joined: 19 Jan 2006
Posts: 2813
Location: Germany, Next to Hamburg
|
| Posted: Thu 22 Jul '10 19:05 Post subject: |
|
|
I wonder how you could get such a good result. My first try today with startcom certs is by 61 point.
Since you know the Kobayashi Maru test, you must have seen Star Trek |
|
| Back to top |
|
Steffen
Moderator
Joined: 14 Oct 2005
Posts: 1193
Location: Hilversum, NL, EU
|
| Posted: Thu 22 Jul '10 19:16 Post subject: |
|
|
First I had a very bad score with a self-signed certificate.
I installed a certificate from https://www.startssl.com/ and now A88.
I changed also my strings in my httpd-ssl.conf to:
SSLProtocol all -SSLv2
SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:!aNULL:!LOW
Try that strings, if you have a bad score.
Btw: startssl (startcom) is very cheap for ~39 Euro you have a wildcard/multidomain certicate for 2 years.
Steffen |
|
| Back to top |
|
James Blond
Moderator
Joined: 19 Jan 2006
Posts: 2813
Location: Germany, Next to Hamburg
|
| Posted: Thu 22 Jul '10 21:13 Post subject: |
|
|
Indeed! I forgot this 
| Code: |
SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM
SSLCertificateChainFile /path/to/sub.class1.server.ca.pem
SSLCACertificateFile /path/to/ca.pem
|
So now it is 79 points
Only the Cipher Strength still laggs with 60 points. I guess I have to compile SSL maybe again, but I don't know if that is so clever. As Gregg mentioned which client will be compatible with such an encryption?
OK adding
| Code: |
SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
|
Than I have 91 points, without recompiling OSSL |
|
| Back to top |
|
glsmith
Moderator
Joined: 16 Oct 2007
Posts: 849
Location: Close enough to Baja to empty the cupboards
|
| Posted: Fri 23 Jul '10 0:20 Post subject: |
|
|
3 words ... I Love StartSSL!
Been using their class 1s for years now, even when IE didn't like them.
Edit:7-23-10
I just stumbled onto this ... vague in a sense but interesting
Overclocking SSL |
|
| Back to top |
|
James Blond
Moderator
Joined: 19 Jan 2006
Posts: 2813
Location: Germany, Next to Hamburg
|
| Posted: Sat 24 Jul '10 8:27 Post subject: |
|
|
I wonder that he prefers 128 bit RC4 to the AES 256 bit. Ok he told that it is 3 times faster. Is there any benchmark?
Bad that some parts are only for apache 2.3 |
|
| Back to top |
|
glsmith
Moderator
Joined: 16 Oct 2007
Posts: 849
Location: Close enough to Baja to empty the cupboards
|
| Posted: Sat 24 Jul '10 20:24 Post subject: |
|
|
| I'd imagine abs.exe for the benchmark. |
|
| Back to top |
|
on 
