Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Getting an A+ on the SSL Labs test in Node.js and Io.js

certsimple.com

Post reply on HN
Print view View original

21–30 of 51 posts

Re: Getting an A+ on the SSL Labs test in Node.js and Io.js

#21

Post by eugeneionesco »

jfroma wrote: post #17
danpalmer wrote: post #3

Isn't this all better implemented in the nginx/apache server in front of the application? I've just done a very similar thing for my Django hosted website, but didn't touch Python at all for it. Edit: Here's a blog post where I detail the steps to set this up in Nginx - https://news.ycombinator.com/item?id=9256200

Yes, I think is better to put nginx in front to handle this and sooner or later you will need some kind of reverse proxy as soon as your application grows. The reasons might be load balancing or just to map components of your app like "app.com" and "app.com/api" being different applications. One big difference to note is that nginx link to the local openssl while node binaries embeds an openssl. If there is a bug in…

>Personally I think nginx is awesome. They are going to support JavaScript soon

Whaaaaaaat?

Re: Getting an A+ on the SSL Labs test in Node.js and Io.js

#22

Post by Thaxll »

samch wrote: post #19
Thaxll wrote: post #16

Why people are that "concerned" about getting A+ on SSL Labs...

I'm not really sure what you're asking about or commenting on here. I will, however, take the opportunity to say that I am a big fan of the SLL Labs Server Test that Ivan Ristic made. With the number of SSL/TLS vulnerabilities over the past few years, it's important to ensure that secure servers stay current with best practices. This tool offers a free way to audit that. Getting an A+ doesn't guarantee security as yo…

The problem by getting an A+ is that you are probably blocking a lot of clients from reaching your service.

Re: Getting an A+ on the SSL Labs test in Node.js and Io.js

#23

Post by agwa »

zaphoyd wrote: post #15

Anyone know of a guide like this for a C or C++ server implemented using raw OpenSSL?

You could look at the source for my titus TLS proxy server[1]. It gets an A out of the box, and an A+ if the application sends the HSTS header.

[1] In particular, these two blocks of code: https://github.com/AGWA/titus/blob/43ecf6889d4c5a61f58de5f8a... https://github.com/AGWA/titus/blob/43ecf6889d4c5a61f58de5f8a...

Re: Getting an A+ on the SSL Labs test in Node.js and Io.js

#24

Post by agwa »

Thaxll wrote: post #22
samch wrote: post #19

Earlier quoted context omitted.

I'm not really sure what you're asking about or commenting on here. I will, however, take the opportunity to say that I am a big fan of the SLL Labs Server Test that Ivan Ristic made. With the number of SSL/TLS vulnerabilities over the past few years, it's important to ensure that secure servers stay current with best practices. This tool offers a free way to audit that. Getting an A+ doesn't guarantee security as yo…

The problem by getting an A+ is that you are probably blocking a lot of clients from reaching your service.

No, that's not true. The only client with non-negligible use that you have to lock out to get an A+ is IE6 (because IE6 only supports SSLv3, at best, by default).

Re: Getting an A+ on the SSL Labs test in Node.js and Io.js

#25

Post by agwa »

samch wrote: post #9

I kind of wish they wouldn't just hand out an A+ that easily. There are clear areas of improvement that the sub-scores call out (90 in both Key Exchange and Cipher Suite). They see the HSTS and grant the A+ when there is clearly improvement that can be made. In my mind, an A+ should be reserved for an SSL/TLS implementation that cannot reasonably be improved upon given the current state of the industry. To improve yo…

> I'd imagine that 4096 will become the new minimum over the next few years.

That's unlikely to happen. 2048-bit RSA provides a security level of ~112 bits, which would physically require a massive amount of energy to break, and it's unlikely that so much energy would ever be expended on a single task. So 2048-bit RSA is only likely to be broken if there's a mathematical breakthrough against RSA. The thing is, such a breakthrough is likely to break 4096-bit RSA as well, so using 4096-bit RSA is only a protection against a minor breakthrough.

Meanwhile, 4096-bit RSA carries a massive performance cost. It's just not worth slowing down your TLS handshake with 4096-bit RSA to protect against a mathematical breakthrough, but not too much of a breakthrough.

So stick with 2048-bit RSA for now, and in a few years when elliptic curve crypto is better supported, switch to that.

Re: Getting an A+ on the SSL Labs test in Node.js and Io.js

#26

Post by jamiesonbecker »

je42 wrote: post #7
danpalmer wrote: post #5

Earlier quoted context omitted.

Fair enough, I'm not familiar with that service. Running a Node.js application without a reverse proxy in front of it sounds like poor practice though, particularly from a security standpoint.

Do you have any particular security holes in mind that nginx guards which node.js / io.js are open for ?

Separating your TLS server from your app server also shields your app server from leaks in your TLS server. See: Heartbleed.

Re: Getting an A+ on the SSL Labs test in Node.js and Io.js

#27

Post by nailer »

Buge wrote: post #10
nailer wrote: post #6

Earlier quoted context omitted.

Edit: added reply to 'vkjv' below as I have hit the comment threshhold and have been unable to reply to this account. Since HN seems to be somewhat unsure of node's concept of IO (why I imagine the downmods) and why it's significantly different to common Python and Ruby setup (Tornado and EventMachine excepted). The main point of nginx is event based, non-blocking IO. That's why traditionally blocking languages (like…

Back in November I spent a lot of time trying to get an A+ for my site throwpass.com. I couldn't get forward secrecy to work and found several places saying node.js doesn't support it. So I ended up forwarding through nginx.

Makes sense. This is likely the same PFS issue covered in the article.

Re: Getting an A+ on the SSL Labs test in Node.js and Io.js

#28

Post by jamiesonbecker »

agwa wrote: post #24
Thaxll wrote: post #22

Earlier quoted context omitted.

The problem by getting an A+ is that you are probably blocking a lot of clients from reaching your service.

No, that's not true. The only client with non-negligible use that you have to lock out to get an A+ is IE6 (because IE6 only supports SSLv3, at best, by default).

IE6 Must Die. Except for China, IE6 is used by less than 1% of the population around the world, according to Microsoft's own data:

https://www.modern.ie/en-us/ie6countdown

Re: Getting an A+ on the SSL Labs test in Node.js and Io.js

#30

Post by agwa »

jamiesonbecker wrote: post #28
agwa wrote: post #24

Earlier quoted context omitted.

No, that's not true. The only client with non-negligible use that you have to lock out to get an A+ is IE6 (because IE6 only supports SSLv3, at best, by default).

IE6 Must Die. Except for China, IE6 is used by less than 1% of the population around the world, according to Microsoft's own data: https://www.modern.ie/en-us/ie6countdown

Indeed. Locking IE6 out to get an A/A+ on SSL Labs is totally worth it.
Post reply on HN