Achieving a Perfect SSL Labs Score with Go
blog.bracelab.com
Achieving a Perfect SSL Labs Score with Go
1–10 of 51 posts
Re: Achieving a Perfect SSL Labs Score with Go
#2> This means I need to take the default CipherSuites and simply remove any that use a cipher smaller than 256bit.
Arguably using a higher bit cipher suite should be considered worse, since it reduces accessibility. 128 bit crypto (specifically the GCM suites) are ridiculously faster, to the point where it is practically free to enable it for all websites. Treating 256bit crypto as better feels like it is missing a key point of security: availability.
Re: Achieving a Perfect SSL Labs Score with Go
#3The driven-by-score configuration keeps a AES256-CBC-SHA cipher but discards a AES128-GCM-SHA2 cipher which is more robust.
Re: Achieving a Perfect SSL Labs Score with Go
#4> This means I need to take the default CipherSuites and simply remove any that use a cipher smaller than 256bit. Arguably using a higher bit cipher suite should be considered worse, since it reduces accessibility. 128 bit crypto (specifically the GCM suites) are ridiculously faster, to the point where it is practically free to enable it for all websites. Treating 256bit crypto as better feels like it is missing a ke…
Right, and they had to salvage HTTP/2 support (which mandates 128 bit AES) in the process.
Re: Achieving a Perfect SSL Labs Score with Go
#5The driven-by-score configuration keeps a AES256-CBC-SHA cipher but discards a AES128-GCM-SHA2 cipher which is more robust.
In fact, using AES256-CBC-SHA will cause Chrome to mark the https with a red strikeout (in the location bar).. because its 'outdated' cryptogrpahy. See:
https://certsimple.com/blog/chrome-outdated-cryptography
Re: Achieving a Perfect SSL Labs Score with Go
#6This is an interesting example of how to get a perfect score on the ssl test.. but it's a terrible config for a production web server.
It only works with the following clients without an error.. since this is when these browsers added TLS 1.2 support (and this config requires tls 1.2):
Android 5+
Firefox 27+
IE 11, Edge
Opera 17+
Safari 7+
It pointlessly excludes clients since TLS 1.0, 1.1 and AES 128 are still considered secure.
Re: Achieving a Perfect SSL Labs Score with Go
#7> No HTTP/2 for you! - HTTP/2 was enabled by default in go 1.6, however HTTP/2 mandates the support of the cipher suite TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256. As this is a 128bit cipher, it needs to be removed. The only way to achieve a perfect score now is to disable HTTP/2.
Why does it have to be this way?
Re: Achieving a Perfect SSL Labs Score with Go
#8to extrapolate: if you disable webserver nobody can access it and hence no security risk at all wohooo
obviously refering to the point that all this tight security will result in lot of issues for most users
Re: Achieving a Perfect SSL Labs Score with Go
#9It's really easy to get an A+ on SSL labs as long as you follow standard modern recommended settings for your certificates and web server (nginx generally being the easiest to set correctly), having said that I see my own crappy blog has dropped from an A+ to an A in the last couple of weeks: https://www.ssllabs.com/ssltest/analyze.html?d=smcleod.net&s...
I highly recommend regularly reading Mozilla's various posts on recommended security settings, especially the TLS best practises for web servers and OpenSSH.
- https://wiki.mozilla.org/Security/Server_Side_TLS
- https://mozilla.github.io/server-side-tls/ssl-config-generat...
Re: Achieving a Perfect SSL Labs Score with Go
#10This is an interesting example of how to get a perfect score on the ssl test.. but it's a terrible config for a production web server. It only works with the following clients without an error.. since this is when these browsers added TLS 1.2 support (and this config requires tls 1.2): Android 5+ Firefox 27+ IE 11, Edge Opera 17+ Safari 7+ It might work on some versions of Chrome after v30 (when tls 1.2 was added) bu…
Exactly. Perfection means you exclude a large percentage of users who are not using a modern browser or who have older handsets. If you running a hobby site then it is fine, but if it is a business this sort of behaviour is insane.