Re: [Pound Mailing List] POODLE, Pound and Branches
Todd Fleisher <todd-IiXteaC/[email protected]>
| Newsgroups | gmane.comp.web.pound.general |
|---|---|
| Message-ID | <[email protected]> |
Joe, Thanks very much for writing this up. My sites were stuck @ A- because of PFS and this was just the tweak I needed to get up to A+ One minor typo correction below is this should read: openssl dhparam -5 2048 -out dh2048.pem Also, folks may want to specify the full path to the resulting dh2048.pem in their configurations to avoid any problems on service restart. -T On Oct 23, 2014, at 1:59 PM, Joe Gooch wrote: > If you're running the official 2.7d (or higher) branch, you do so with: > Disable SSLv3 > > which also implicitly disables SSLv2. > > To get an A on SSLLabs, you'll need to do *more* than that. I run this: > 8<---------------- > #dh2048.pem generated with openssl dhparams -5 2048 -out dh2048.pem > DHParams "dh2048.pem" > ECDHCurve prime256v1 > > ListenHTTPS > ..... > SSLAllowClientRenegotiation 0 > SSLHonorCipherOrder 1 > > Ciphers > "EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:EDH+aRSA:-RC4:EECDH+aRSA+RC4:EECDH+RC4:EDH+aRSA+RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:RC4+SHA" > ..... > 8<---------------- > > If you need Java 6 support, you need to do DH 1024 bit instead of 2048 > bit. (Pound's default for strong ciphers) > If you're not interested in RC4 compatibility for older browsers, use a > Ciphers line more like this: > Ciphers > "EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS" > > You need to be running OpenSSL 1.0+ for this to make any difference. > Otherwise you won't have ECDHE or half the ciphers I've listed. And for > FALLBACK_SCSV reasons, you're going to want OpenSSL 1.0.1j or better, or > if you're using 1.0.0 you'll want 1.0.0o or better. (See US-CERT > Advisory here > https://www.us-cert.gov/ncas/current-activity/2014/10/16/OpenSSL-Patches-Four-Vulnerabilities) -- To unsubscribe send an email with subject unsubscribe to [email protected] Please contact [email protected] for questions.