Topic: Test Your SSL Server Now! SSL Labs

[Steffen]

Ivan Ristic (mod_security author) has a fantastic tool on his site to test your SSL configuration.

Go to http://www.ssllabs.com , at the bottom enter your domain name for a detailed security assessment of your SSL server.


Steffen

[James Blond]

I made that test. It tells me that I use insecure SSL 2.0. How can I turn that off in httpd.conf? Yepp I'm to lazy for RTFM

[glsmith]

SSLProtocol all -SSLv2

Edit:

Actually, if you are speaking of this one:
SSL 2.0+ Upgrade Support

The only way to remove it is to disable sslv3 as well.
SSLProtocol +TLSv1

Doing that and removing DES cipher during my new OSSL build, I have been able to achieve a overall score of 90.

My first score was a 76, second (DES removed) was 85, now a 90. I wonder what clients are around that are not compatible with this setup. Should I even care becomes the next question.

This test is a Kobayashi Maru as it seems impossible to get a 100 today cause as far as I know TLS/1.2 is nothing more than theory at this time. TLS1.1 will be in OSSL 1.0.1 IIRC, that still leaves the server unable to get a 100.

Edit 2:

Doing this actually changed the PCI Complaint flag from No to Yes

[James Blond]

I wonder how you could get such a good result. My first try today with startcom certs is by 61 point.

Since you know the Kobayashi Maru test, you must have seen Star Trek

[Steffen]

First I had a very bad score with a self-signed certificate.

I installed a certificate from https://www.startssl.com/ and now A88.

I changed also my strings in my httpd-ssl.conf to:

SSLProtocol all -SSLv2
SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:!aNULL:!LOW

Try that strings, if you have a bad score.

Btw: startssl (startcom) is very cheap for ~39 Euro you have a wildcard/multidomain certicate for 2 years.

Steffen

[James Blond]

Indeed! I forgot this

[glsmith]

3 words ... I Love StartSSL!
Been using their class 1s for years now, even when IE didn't like them.

Edit:7-23-10

I just stumbled onto this ... vague in a sense but interesting
Overclocking SSL

[James Blond]

I wonder that he prefers 128 bit RC4 to the AES 256 bit. Ok he told that it is 3 times faster. Is there any benchmark?
Bad that some parts are only for apache 2.3

[glsmith]

I'd imagine abs.exe for the benchmark.

[k.anderson3454]

This is complicated.

[kitteh]

hey, this is a nice tool I got an 85 when I ran my site (it gave me an A that must not be too bad!)
Looks like my weakest area was the "Key Exchange" but it doesn't say anything else about it in the details, is there something I can do to improve that aspect?

[James Blond]

If you create a key, make sure that your key size is 4096 and not 2048.

[west]

Doing this actually changed the PCI Complaint flag from No to Yes