Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How's my SSL?

howsmyssl.com

Post reply on HN
Print view View original

31–40 of 91 posts

Re: How's my SSL?

#31

Post by [deleted] »

josho wrote: post #20
mathrawka wrote: post #12

And for testing your servers: https://www.ssllabs.com/ssltest/analyze.html

Thanks for that. I'm surprised to find that Apple's OSX Server (Mavericks) ships without TLS 1.1 or 1.2 support. Are these not widely deployed? Or no sense of urgency since 1.0 isn't broken.

[deleted]

Re: How's my SSL?

#33

Post by djcapelis »

MWil wrote: post #26
trentmb wrote: post #4

Earlier quoted context omitted.

It only took changing two settings in about:config to get FF 26 to 'pass.' security.tls.version.max = 3 security.ssl3.rsa_fips_des_ede3_sha = false

anything wrong with setting both the min AND max to 3?

Some websites may not work over TLS if they don't support it.

Re: How's my SSL?

#34

Post by djcapelis »

jjjeffrey wrote: post #28
trentmb wrote: post #4

Earlier quoted context omitted.

It only took changing two settings in about:config to get FF 26 to 'pass.' security.tls.version.max = 3 security.ssl3.rsa_fips_des_ede3_sha = false

Say I change security.tls.version.max to 3, which changes it's status from 'default' to 'user set'. In the future, if the default for security.tls.version.max is changed to, say, 4, would the fact that my setting has the 'user set' status prevent it from incrementing to the better default? I'm not proposing that this is a risk or that Firefox behaves this way---I have no idea. Does anyone else know?

I believe it would, but I'm not certain. This is one of reasons not to mess with it and just wait until the next version which will be out RSN (real soon now) that has a better default.

For whatever it's worth though, while I'm not sure how they're doing their version numbers and it may be quite awhile until this is relevant, you could probably just set the integer really high (like 99 or something) and that would effectively translate into "try the highest version you've got" which might break things sometimes, but it wouldn't leave you stuck in a lower version later at least.

Re: How's my SSL?

#35

Post by jftuga »

trentmb wrote: post #4
PeterWhittaker wrote: post #2

Excellent! (I mean the site. Not so crazy that FF 26 under OSX 10.9.1 is listed as BAD, but I understand and accept the reasoning.) Hopefully this will spur the various vendors to abandon old, broken protocols and ciphers.

It only took changing two settings in about:config to get FF 26 to 'pass.' security.tls.version.max = 3 security.ssl3.rsa_fips_des_ede3_sha = false

Thanks. This made my FF 26.0 go from Bad to Probably Okay.

Re: How's my SSL?

#36

Post by ecaron »

fexl wrote: post #32

Does anyone know how to disable TLS 1.0 in Firefox 26.0 (on Linux)? I found this article: http://www.spotht.com/2010/06/how-to-enabledisable-ssl-30-an... However, the Options in my browser do not include a tab called "Encryption", as the article discusses.

You want to use about:config. More details on it are at https://support.mozilla.org/en-US/questions/967266

Re: How's my SSL?

#37

Post by qoo »

Loading https://www.howsmyssl.com/ results in:

Secure Connection Failed

An error occurred during a connection to www.howsmyssl.com. Peer attempted old style (potentially vulnerable) handshake. (Error code: ssl_error_unsafe_negotiation)

My firefox config "security.ssl.treat_unsafe_negotiation_as_broken" is set to true

Re: How's my SSL?

#38

Post by Spittie »

fexl wrote: post #32

Does anyone know how to disable TLS 1.0 in Firefox 26.0 (on Linux)? I found this article: http://www.spotht.com/2010/06/how-to-enabledisable-ssl-30-an... However, the Options in my browser do not include a tab called "Encryption", as the article discusses.

I think you should look at security.tls.version.min (in about:config): http://kb.mozillazine.org/Security.tls.version.*

Re: How's my SSL?

#39

Post by MWil »

djcapelis wrote: post #33
MWil wrote: post #26

Earlier quoted context omitted.

anything wrong with setting both the min AND max to 3?

Some websites may not work over TLS if they don't support it.

yeah I found that out already. So far so good with most of my regular sites with min: 2, max:3

Re: How's my SSL?

#40

Post by hundchenkatze »

fexl wrote: post #32

Does anyone know how to disable TLS 1.0 in Firefox 26.0 (on Linux)? I found this article: http://www.spotht.com/2010/06/how-to-enabledisable-ssl-30-an... However, the Options in my browser do not include a tab called "Encryption", as the article discusses.

change security.tls.version.min to 2 in about:config

0 = SSLv3 1 = TLSv1.0 2 = TLSv1.1 3 = TLSv1.2

For reference: http://kb.mozillazine.org/Security.tls.version.*

Post reply on HN