OK I got all good for chrome, and half bad for firefox, what should I do...
Read the comments explaining why the site is (mostly) wrong?
How's my SSL?
61–70 of 91 posts
Re: How's my SSL?
#62On the built in browser in CyanogenMod 10.1.3: > Bad: Your client is using TLS 1.0, which is very old, possibly susceptible to the BEAST attack, and doesn't have the best cipher suites available either. Interestingly I get "Probably good" using the Chrome browser on the same phone.
Chrome on Android ships with its own copy of OpenSSL and so can do things different than Android Browser.
It's not using NSS? (I was going to correct you but then I remembered who you are...)
Re: How's my SSL?
#63Very useful Site - Thanks! Reminded me of an old favorite "Shields Up" https://www.grc.com/shieldsup - Great way to quickly test your Router
A router's job is to forward traffic between its multiple interfaces to ensure packets get where they are addressed to go. They generally look like this: http://www.ebay.com/itm/Cisco-CCNA-CCNP-LAB-2500-2501-ROUTER... I think you mean "firewall" or maybe "NAT box".
The vast majority of the times I hear the word "router" nowadays, it refers to the box everyone with broadband internet has at home, connecting the internet (via DSL/cable modem) and the home network (via ethernet/wifi).
Are you saying that's not a router? I'm pretty sure there are more of those deployed than the big kind.
Re: How's my SSL?
#64[deleted]
Re: How's my SSL?
#65Site doesn't load on IE 6. I wonder if you've configured the SSL certs with SNI? Would have been nice to see the page turn red, but I guess I know the answer without having to run it...
Edit: It's not an SNI issue, IE 8 on XP can load the site.
Re: How's my SSL?
#66Earlier quoted context omitted.
IIRC they just ship Apache, so just follow the normal instructions for enabling perfect forward secrecy on Apache.
They ship Apache, but they only ship obsolescent (0.9.8) versions of OpenSSL. So their system Apache is built against OpenSSL 0.9.8y.
Thats rather unfortunate. I think you can use Homebrew to pull in newer stuff, though, but I haven't tried (I don't host stuff on my MBP, I use my Linux workstation for that).
Re: How's my SSL?
#67And for testing your servers: https://www.ssllabs.com/ssltest/analyze.html
SSL Labs also has a client test: https://www.ssllabs.com/ssltest/viewMyClient.html
And, if you're curious about client-side SSL support in general, every server test page simulates about 20 most popular (or important) clients. Scroll down to the "Handshake Simulation" section. If you click on client name you get the full-page client report. https://www.ssllabs.com/ssltest/analyze.html?d=www.ssllabs.c...
Re: How's my SSL?
#68wget, w3m, lynx, and links are all rated “bad” here… :( Is there any way to improve this?
Those are probably all linked against OpenSSL so that's what you would need to upgrade.
Re: How's my SSL?
#69Site doesn't load on IE 6. I wonder if you've configured the SSL certs with SNI? Would have been nice to see the page turn red, but I guess I know the answer without having to run it... Edit: It's not an SNI issue, IE 8 on XP can load the site.
MSIE6 does not support new enough SSL to be considered secure. I wouldn't be surprised if a lot of sites no longer work with MSIE 6 over the next two years as sites transition to turning RC4 and SHA1 off.
Re: How's my SSL?
#70Some info on how to correct this on common browsers where it can be corrected (I use FF 26; marked bad, and comments in this thread say that some of the problems can be fixed) would be a great improvement.
You can "fix" the result on this webpage by flipping some settings in Firefox, but it will cause some websites to no longer work (guess why they aren't defaulted?). Newer versions (27 and up) will detect this and work around appropriately. They also have those settings by default. If you absolutely require this website to tell you you're safe so you get a warm fuzzy feeling and can sleep at night, update to Firefox B…
Correct. Firefox and all other modern browsers use the so-called 1/n-1 split technique to mitigate the BEAST attack. It's actually possible to test if the mitigation is present; it's just that this site has not implemented it.