Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How's my SSL?

howsmyssl.com

Post reply on HN
Print view View original

51–60 of 91 posts

Re: How's my SSL?

#52

Post by tptacek »

josho wrote: post #20
mathrawka wrote: post #12

And for testing your servers: https://www.ssllabs.com/ssltest/analyze.html

Thanks for that. I'm surprised to find that Apple's OSX Server (Mavericks) ships without TLS 1.1 or 1.2 support. Are these not widely deployed? Or no sense of urgency since 1.0 isn't broken.

TLS 1.0 is definitely broken; TLS 1.1 introduced explicit per-record IVs for CBC mode.

Re: How's my SSL?

#53

Post by ddp »

trentmb wrote: post #4
PeterWhittaker wrote: post #2

Excellent! (I mean the site. Not so crazy that FF 26 under OSX 10.9.1 is listed as BAD, but I understand and accept the reasoning.) Hopefully this will spur the various vendors to abandon old, broken protocols and ciphers.

It only took changing two settings in about:config to get FF 26 to 'pass.' security.tls.version.max = 3 security.ssl3.rsa_fips_des_ede3_sha = false

I recommend disabling all the RC4 suites as well.

Re: How's my SSL?

#54

Post by wiml »

DiabloD3 wrote: post #44
josho wrote: post #20

Earlier quoted context omitted.

Thanks for that. I'm surprised to find that Apple's OSX Server (Mavericks) ships without TLS 1.1 or 1.2 support. Are these not widely deployed? Or no sense of urgency since 1.0 isn't broken.

IIRC they just ship Apache, so just follow the normal instructions for enabling perfect forward secrecy on Apache.

They ship Apache, but they only ship obsolescent (0.9.8) versions of OpenSSL. So their system Apache is built against OpenSSL 0.9.8y.

Re: How's my SSL?

#56

Post by sebcat »

evv wrote: post #7

Unfortunately "Bad" results for cURL: $ curl https://www.howsmyssl.com/a/check | python -mjson.tool

I think that would depend on how cURL is built, and not curl itself. OpenSSL 0.9.8 versions (still widely deployed) did not support TLS 1.[12], I think that was added in 1.0.1c.

You can check which version of OpenSSL curl is using by doing $ curl -V

Re: How's my SSL?

#59

Post by zurn »

suprgeek wrote: post #49

Very useful Site - Thanks! Reminded me of an old favorite "Shields Up" https://www.grc.com/shieldsup - Great way to quickly test your Router

A router's job is to forward traffic between its multiple interfaces to ensure packets get where they are addressed to go. They generally look like this: http://www.ebay.com/itm/Cisco-CCNA-CCNP-LAB-2500-2501-ROUTER...

I think you mean "firewall" or maybe "NAT box".

Post reply on HN