Commit Graph

19 Commits (ea01dd51b20cfabe81363bfbee63d975bef94c68)

Author SHA1 Message Date
Raymond Yee 486e474fc3 Set the SSL configuration to that generated by
https://mozilla.github.io/server-side-tls/ssl-config-generator/
intermediate mode
2015.03.04   (with Apache v 2.2.22 and OpenSSL 1.0.1 and HSTS enabled)
2015-03-11 10:10:48 -07:00
Raymond Yee 949f22415b a modern configuration from https://mozilla.github.io/server-side-tls/ssl-config-generator/ 2015-03-10 16:07:15 -07:00
Raymond Yee cdb84dfffa Working conclusion: use the configuration:
SSLProtocol             all -SSLv2 -SSLv3
SSLCipherSuite          ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
SSLHonorCipherOrder     on
2015-03-10 15:48:02 -07:00
Raymond Yee 2e274b4e2b config without RC4
://community.qualys.com/blogs/securitylabs/2013/08/05/configuring-apache-nginx-and-openssl-for-forward-secrecy
2015-03-05 12:30:47 -08:00
Raymond Yee 8506df2480 need "" around ciphers 2015-03-05 12:26:40 -08:00
Raymond Yee 2685940069 ooops typo 2015-03-05 12:25:34 -08:00
Raymond Yee c9a0fc8ee7 tweak from the article
SSLCipherSuite EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS +RC4 RC4
2015-03-05 12:24:20 -08:00
Raymond Yee bcc1abed00 Now let's try https://community.qualys.com/blogs/securitylabs/2013/08/05/configuring-apache-nginx-and-openssl-for-forward-secrecy 2015-03-05 12:15:12 -08:00
Raymond Yee 25b8749206 Let's see what using the old configuration to be more compatible with old browsers does for the ssl test 2015-03-05 12:07:30 -08:00
Raymond Yee 9477ae66f2 first config try didn't up our score....now trying config generated by mozilla 2015-03-04 11:35:25 -08:00
Raymond Yee 5c64cfac38 testing SSL configuration to try to disallow RC4 and enable forward secrecy 2015-03-04 10:53:54 -08:00
Raymond Yee 22c917eb65 let's try redirecting everything 2014-12-12 13:47:25 -08:00
Raymond Yee 685e827e44 Turning off SSL v2 and SSL v3 from Apache to patch against POODLE vulnerability: http://askubuntu.com/questions/537196/how-do-i-patch-workaround-sslv3-poodle-vulnerability-cve-2014-3566 2014-10-15 14:56:59 -07:00
Raymond Yee 91250d937b it seems key issue is lack of
ServerName just.unglue.it:443
2014-05-23 17:57:40 -07:00
Raymond Yee af016cc0fb adding to apache conf:
SSLProtocol all -SSLv2 +TLSv1
2014-05-23 17:25:40 -07:00
eric 2892a22824 change terminology from "donation" to "gift" 2013-12-13 15:15:35 -05:00
Raymond Yee 4fa7ea75ba update just.conf to move from just.unglueit.com -> just.unglue.it and for using a different CA 2013-01-07 20:53:43 -05:00
Raymond Yee 2ff9d4a4d3 [#38999845] Redirect pledge and donation pages to https 2012-11-05 21:58:30 +00:00
Ed Summers 509bff4d52 Configuration files for just.unglueit.com 2012-05-07 18:44:01 +00:00