486e474fc3
Set the SSL configuration to that generated by
...
https://mozilla.github.io/server-side-tls/ssl-config-generator/
intermediate mode
2015.03.04 (with Apache v 2.2.22 and OpenSSL 1.0.1 and HSTS enabled)
2015-03-11 10:10:48 -07:00
949f22415b
a modern configuration from https://mozilla.github.io/server-side-tls/ssl-config-generator/
2015-03-10 16:07:15 -07:00
cdb84dfffa
Working conclusion: use the configuration:
...
SSLProtocol all -SSLv2 -SSLv3
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
SSLHonorCipherOrder on
2015-03-10 15:48:02 -07:00
2e274b4e2b
config without RC4
...
://community.qualys.com/blogs/securitylabs/2013/08/05/configuring-apache-nginx-and-openssl-for-forward-secrecy
2015-03-05 12:30:47 -08:00
8506df2480
need "" around ciphers
2015-03-05 12:26:40 -08:00
2685940069
ooops typo
2015-03-05 12:25:34 -08:00
c9a0fc8ee7
tweak from the article
...
SSLCipherSuite EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS +RC4 RC4
2015-03-05 12:24:20 -08:00
bcc1abed00
Now let's try https://community.qualys.com/blogs/securitylabs/2013/08/05/configuring-apache-nginx-and-openssl-for-forward-secrecy
2015-03-05 12:15:12 -08:00
25b8749206
Let's see what using the old configuration to be more compatible with old browsers does for the ssl test
2015-03-05 12:07:30 -08:00
9477ae66f2
first config try didn't up our score....now trying config generated by mozilla
2015-03-04 11:35:25 -08:00
5c64cfac38
testing SSL configuration to try to disallow RC4 and enable forward secrecy
2015-03-04 10:53:54 -08:00
22c917eb65
let's try redirecting everything
2014-12-12 13:47:25 -08:00
685e827e44
Turning off SSL v2 and SSL v3 from Apache to patch against POODLE vulnerability: http://askubuntu.com/questions/537196/how-do-i-patch-workaround-sslv3-poodle-vulnerability-cve-2014-3566
2014-10-15 14:56:59 -07:00
91250d937b
it seems key issue is lack of
...
ServerName just.unglue.it:443
2014-05-23 17:57:40 -07:00
af016cc0fb
adding to apache conf:
...
SSLProtocol all -SSLv2 +TLSv1
2014-05-23 17:25:40 -07:00
2892a22824
change terminology from "donation" to "gift"
2013-12-13 15:15:35 -05:00
4fa7ea75ba
update just.conf to move from just.unglueit.com -> just.unglue.it and for using a different CA
2013-01-07 20:53:43 -05:00
2ff9d4a4d3
[ #38999845 ] Redirect pledge and donation pages to https
2012-11-05 21:58:30 +00:00
509bff4d52
Configuration files for just.unglueit.com
2012-05-07 18:44:01 +00:00
Raymond Yee
eric
Ed Summers