Comment by acabal | Hacker News Reader

Comment by acabal | Hacker News Reader

Parent Full thread

So posts about what you can screw up are nice, but what would be nicer is posts about how to set up an ideal SSL configuration for various web servers. (Perhaps there's no "perfect" configuration possible, but "strongest given known limitations" would be fine too.)

With all the talk of PFS lately I've been trying to configure Apache to do it, but either I'm dumber than I thought or there's no straightforward how-to online at the moment.

Instead of telling us the various crazy pitfalls and edge cases, just give dummies like me the best possible formula so we can configure things securely and then get on with our lives. The first step towards defeating eavesdropping is making the best possible SSL configuration a copy and paste affair instead of an acronym guessing game.

Edit: If total security isn't really possible right now as this post suggests, maybe a "best" configuration plus mailing list for when it's updated for varios major platforms (ie LTS) would be a good stopgap.

I think one of the biggest pitfalls of SSL/TLS (and many other security technologies available now) is that they are so configurable and flexible. The approach assumes everyone has the knowledge and the time to invest to tune everything. In reality, few people do.

Going back to your request, it's impossible to do with server configuration alone. Many other aspects, including the design of the web application, play a significant role. The best we can do at this point is work on the body of knowledge, hoping others can find the time to invest.

The best I was able to do so far is build the SSL Labs test[1], write the SSL/TLS Deployment Best Practices guide[2], and start the SSL Research Wiki[3], where I intend to add other un-structured information over time (including example server configuration). I have also written a free OpenSSL Cookbook[4] (requires registration, and you can opt out of email afterwards).

Apologies if this post comes across as self-promoting, but this is what I spent a large amount of my time on. These are all genuinely useful and important resources.

[1] https://www.ssllabs.com/ssltest/

[2] https://www.ssllabs.com/projects/best-practices/

[3] https://github.com/ssllabs/research/wiki

[4] https://www.feistyduck.com/books/bulletproof-ssl-tls-and-pki...

Thank you very much for your great work, I've found both the SSL Labs test and the best practice guide quite useful!

https://github.com/ioerror/duraconf might answer some questions...

This is problematic in itself, because the "best" configuration changes from time to time.

That said -- perfect, good, enemies etc.

Reply on news.ycombinator.com