Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Getting an A+ on the SSL Labs test in Node.js and Io.js

certsimple.com

Post reply on HN
Print view View original

11–20 of 51 posts

Re: Getting an A+ on the SSL Labs test in Node.js and Io.js

#11

Post by nailer »

samch wrote: post #9

I kind of wish they wouldn't just hand out an A+ that easily. There are clear areas of improvement that the sub-scores call out (90 in both Key Exchange and Cipher Suite). They see the HSTS and grant the A+ when there is clearly improvement that can be made. In my mind, an A+ should be reserved for an SSL/TLS implementation that cannot reasonably be improved upon given the current state of the industry. To improve yo…

Thanks & agreed completely. I'm working on a followup improving the cipher suite score (with a couple of options depending on browser compromises).

I'll do some research around 4096 bit key support. I'm also checking out OCSP stapling.

Edit: precursory investigations show 4096 bit keys generally good to go with a few exceptions, eg AWS CloudFront:http://docs.aws.amazon.com/AmazonCloudFront/latest/Developer...

Re: Getting an A+ on the SSL Labs test in Node.js and Io.js

#12

Post by vkjv »

nailer wrote: post #6
danpalmer wrote: post #3

Isn't this all better implemented in the nginx/apache server in front of the application? I've just done a very similar thing for my Django hosted website, but didn't touch Python at all for it. Edit: Here's a blog post where I detail the steps to set this up in Nginx - https://news.ycombinator.com/item?id=9256200

Edit: added reply to 'vkjv' below as I have hit the comment threshhold and have been unable to reply to this account. Since HN seems to be somewhat unsure of node's concept of IO (why I imagine the downmods) and why it's significantly different to common Python and Ruby setup (Tornado and EventMachine excepted). The main point of nginx is event based, non-blocking IO. That's why traditionally blocking languages (like…

While node.js is great at non-blocking IO, it's not great at the blocking kind. E.g., shuffling bytes.

While you are correct that node.js is happily not blocking the main thread while reading from disk, once that returns it still needs to serialize that data from I/O to the request and that is both blocking and slow.

I highly advise that you don't use node.js to service static content outside of a development environment. And if you are already using nginx in front of node, you might as well use it for SSL.

As a bonus, nginx does a great job proxying multiple node.js processes. You could also use the cluster module, but last time I checked, that was still marked as experimental.

Re: Getting an A+ on the SSL Labs test in Node.js and Io.js

#13

Post by [deleted] »

Buge wrote: post #10
nailer wrote: post #6

Earlier quoted context omitted.

Edit: added reply to 'vkjv' below as I have hit the comment threshhold and have been unable to reply to this account. Since HN seems to be somewhat unsure of node's concept of IO (why I imagine the downmods) and why it's significantly different to common Python and Ruby setup (Tornado and EventMachine excepted). The main point of nginx is event based, non-blocking IO. That's why traditionally blocking languages (like…

Back in November I spent a lot of time trying to get an A+ for my site throwpass.com. I couldn't get forward secrecy to work and found several places saying node.js doesn't support it. So I ended up forwarding through nginx.

[deleted]

Re: Getting an A+ on the SSL Labs test in Node.js and Io.js

#14

Post by masta »

The explanation of the Full cipher suite format has some tiny mistakes for the explained case.

> Use GCM for the cipher mode > Use SHA256 for message authentication (making sure messages haven't been tampered with)

GCM is an AEAD-Mode, it builts upon CTR-Mode, but also provides message authentication. SHA256 is used as a PRF (Pseudo Random Function) to generate key material based on the master secrect. See https://tools.ietf.org/html/rfc5246 Section 5 for more information.

Re: Getting an A+ on the SSL Labs test in Node.js and Io.js

#17

Post by jfroma »

danpalmer wrote: post #3

Isn't this all better implemented in the nginx/apache server in front of the application? I've just done a very similar thing for my Django hosted website, but didn't touch Python at all for it. Edit: Here's a blog post where I detail the steps to set this up in Nginx - https://news.ycombinator.com/item?id=9256200

Yes, I think is better to put nginx in front to handle this and sooner or later you will need some kind of reverse proxy as soon as your application grows. The reasons might be load balancing or just to map components of your app like "app.com" and "app.com/api" being different applications.

One big difference to note is that nginx link to the local openssl while node binaries embeds an openssl. If there is a bug in openssl I can apt-get update/upgrade and I get the patch very early.

Personally I think nginx is awesome. They are going to support JavaScript soon, but I have done things with LUA and is great too.

Re: Getting an A+ on the SSL Labs test in Node.js and Io.js

#18

Post by danpalmer »

je42 wrote: post #7
danpalmer wrote: post #5

Earlier quoted context omitted.

Fair enough, I'm not familiar with that service. Running a Node.js application without a reverse proxy in front of it sounds like poor practice though, particularly from a security standpoint.

Do you have any particular security holes in mind that nginx guards which node.js / io.js are open for ?

Not off the top of my head, although I know the recommendation at least used to be that Node was not run with full public access.

I think it makes sense to separate the security and low level details of serving a public site, and the details of hosting an application though. This is common practice with Django, using gunicorn and nginx, and I believe with Ruby as well in a similar manner.

Re: Getting an A+ on the SSL Labs test in Node.js and Io.js

#19

Post by samch »

Thaxll wrote: post #16

Why people are that "concerned" about getting A+ on SSL Labs...

I'm not really sure what you're asking about or commenting on here. I will, however, take the opportunity to say that I am a big fan of the SLL Labs Server Test that Ivan Ristic made. With the number of SSL/TLS vulnerabilities over the past few years, it's important to ensure that secure servers stay current with best practices. This tool offers a free way to audit that.

Getting an A+ doesn't guarantee security as your application and infrastructure must all be kept current and secured. The A+, however, is intended as an indicator that your SSL/TLS is configured to provide the optimal level of security around the transport layer. If a site gets a grade of B, that doesn't necessarily make it insecure, but it does indicate that certain vulnerabilities could expose their users' data.

Re: Getting an A+ on the SSL Labs test in Node.js and Io.js

#20

Post by ouaibe »

I did split ioerror's duraconf nginx configs in 3 distinct configs with different ciphersuites lists, that specifically list desired ciphers in order, targetting :

- Very high security with low compatibility.

- PFS-only moderate security with high compatibility.

- PFS-centric moderate security with very high compatibility.

All of them give an A on Qualys SSL Labs test.

https://github.com/ouaibe/duraconf/tree/master/configs/nginx

Post reply on HN