Getting an A+ on the SSL Labs test in Node.js and Io.js
certsimple.com
Getting an A+ on the SSL Labs test in Node.js and Io.js
1–10 of 51 posts
Re: Getting an A+ on the SSL Labs test in Node.js and Io.js
#2Hi there, author here.
This began as an exercise in improving the rating for an individual website, the iojs advocacy just came as a side effect of investigating what was needed and running into the megapatch in iojs (https://github.com/iojs/io.js/pull/826) where they fixed the tls defaults affecting node 0.12's out of the box score.
Let me know if you have any additions or corrections, there's also an express boilerplate app used to pass the tests here: https://github.com/mikemaccana/ssltest
Re: Getting an A+ on the SSL Labs test in Node.js and Io.js
#3Isn't this all better implemented in the nginx/apache server in front of the application?
I've just done a very similar thing for my Django hosted website, but didn't touch Python at all for it.
Edit: Here's a blog post where I detail the steps to set this up in Nginx - https://news.ycombinator.com/item?id=9256200
Re: Getting an A+ on the SSL Labs test in Node.js and Io.js
#4Isn't this all better implemented in the nginx/apache server in front of the application? I've just done a very similar thing for my Django hosted website, but didn't touch Python at all for it. Edit: Here's a blog post where I detail the steps to set this up in Nginx - https://news.ycombinator.com/item?id=9256200
Sometimes you're running a single application via AWS OpsWorks or so, and your application is handling the SSL because you don't want to pay for an elastic load balancer to handle the SSL.
Re: Getting an A+ on the SSL Labs test in Node.js and Io.js
#5Isn't this all better implemented in the nginx/apache server in front of the application? I've just done a very similar thing for my Django hosted website, but didn't touch Python at all for it. Edit: Here's a blog post where I detail the steps to set this up in Nginx - https://news.ycombinator.com/item?id=9256200
Sometimes you're running a single application via AWS OpsWorks or so, and your application is handling the SSL because you don't want to pay for an elastic load balancer to handle the SSL.
Fair enough, I'm not familiar with that service.
Running a Node.js application without a reverse proxy in front of it sounds like poor practice though, particularly from a security standpoint.
Re: Getting an A+ on the SSL Labs test in Node.js and Io.js
#6Isn't this all better implemented in the nginx/apache server in front of the application? I've just done a very similar thing for my Django hosted website, but didn't touch Python at all for it. Edit: Here's a blog post where I detail the steps to set this up in Nginx - https://news.ycombinator.com/item?id=9256200
Edit: added reply to 'vkjv' below as I have hit the comment threshhold and have been unable to reply to this account. Since HN seems to be somewhat unsure of node's concept of IO (why I imagine the downmods) and why it's significantly different to common Python and Ruby setup (Tornado and EventMachine excepted).
The main point of nginx is event based, non-blocking IO. That's why traditionally blocking languages (like your Python setup) use nginx for static content and their own engines for dynamic stuff.
However event based, non-blocking IO is also the main point of node. So most people using, say Express would use the express module's inbuilt 'static' middleware rather than add an entire webserver to replicate the built-in functionality.
Unless there's a compelling reason to do SSL elsewhere (for example, an AWS ELB would allow you to isolate & consolidate your SSL in a separate layer) then you'd want to avoid adding complexity.
Edit: reply to vkjv:
> it still needs to serialize that data from I/O to the request and that is both blocking and slow.
No. If the socket wasn't ready, node wouldn't block writing data there. streams are evented and that includes sockets. Hence the callback on socket.write() https://nodejs.org/api/net.html#net_socket_write_data_encodi...
var socket = new net.Socket();
socket.write(...)
console.log('Yep sockets are non blocking too')
Agreed, if you're already using nginx for other reasons, eg, load balancing, you should use nginx for SSL. If you're not, think carefully before doubling the size of your stack without specific reason to do so.
Re: Getting an A+ on the SSL Labs test in Node.js and Io.js
#7Earlier quoted context omitted.
Sometimes you're running a single application via AWS OpsWorks or so, and your application is handling the SSL because you don't want to pay for an elastic load balancer to handle the SSL.
Fair enough, I'm not familiar with that service. Running a Node.js application without a reverse proxy in front of it sounds like poor practice though, particularly from a security standpoint.
Do you have any particular security holes in mind that nginx guards which node.js / io.js are open for ?
Re: Getting an A+ on the SSL Labs test in Node.js and Io.js
#8Isn't this all better implemented in the nginx/apache server in front of the application? I've just done a very similar thing for my Django hosted website, but didn't touch Python at all for it. Edit: Here's a blog post where I detail the steps to set this up in Nginx - https://news.ycombinator.com/item?id=9256200
Edit: added reply to 'vkjv' below as I have hit the comment threshhold and have been unable to reply to this account. Since HN seems to be somewhat unsure of node's concept of IO (why I imagine the downmods) and why it's significantly different to common Python and Ruby setup (Tornado and EventMachine excepted). The main point of nginx is event based, non-blocking IO. That's why traditionally blocking languages (like…
I just recently was in this same situation (deciding whether to serve static via express' static middleware or nginx), and nginx proved to be a better choice - the response (on a non-loaded server) was faster, and less server CPU time was used up.
Wasn't a scientific test, but the results were consistent enough for us to decide to use nginx.
(FWIW, neither nginx nor node did SSL termination - we have haproxy in front of them taking care of that and the load balancing itself).
Re: Getting an A+ on the SSL Labs test in Node.js and Io.js
#9I kind of wish they wouldn't just hand out an A+ that easily. There are clear areas of improvement that the sub-scores call out (90 in both Key Exchange and Cipher Suite). They see the HSTS and grant the A+ when there is clearly improvement that can be made. In my mind, an A+ should be reserved for an SSL/TLS implementation that cannot reasonably be improved upon given the current state of the industry.
To improve your Key Exchange score you can bump your certificate from a 2048-bit key up to 4096-bit (giving you a score of 100). That's probably a good idea anyway as 2048 has been the minimum safe key size since 2010 [1], and I'd imagine that 4096 will become the new minimum over the next few years.
To improve your Cipher Suite score you can easily drop support for payload encryption with keys less than 256 bits in length. You will risk not supporting IE 6 users, but that's a fringe case these days (and there are many more issues with supporting IE 6 on top of that).
Making those adjustments, you should be able to get your scores to 100,95,100,100 which, in my opinion, is much more worthy of an A+.
There may be a few other tweaks you can make to improve items in the Protocol Details section, but I don't know enough about the node.js/io.js system to be able to recommend a clear path for improvement there.
The only score that you really would have difficulty bumping to 100 is the Protocol Support which is limited by the fact that all versions of IE prior to 11 had TLS 1.1 and 1.2 disabled by default. Unfortunately, there are still many IE 9 and 10 users out there
1. http://csrc.nist.gov/publications/nistpubs/800-131A/sp800-13...
Re: Getting an A+ on the SSL Labs test in Node.js and Io.js
#10Isn't this all better implemented in the nginx/apache server in front of the application? I've just done a very similar thing for my Django hosted website, but didn't touch Python at all for it. Edit: Here's a blog post where I detail the steps to set this up in Nginx - https://news.ycombinator.com/item?id=9256200
Edit: added reply to 'vkjv' below as I have hit the comment threshhold and have been unable to reply to this account. Since HN seems to be somewhat unsure of node's concept of IO (why I imagine the downmods) and why it's significantly different to common Python and Ruby setup (Tornado and EventMachine excepted). The main point of nginx is event based, non-blocking IO. That's why traditionally blocking languages (like…
Back in November I spent a lot of time trying to get an A+ for my site throwpass.com. I couldn't get forward secrecy to work and found several places saying node.js doesn't support it. So I ended up forwarding through nginx.