Improve SSL Labs Rating by tweaking TLS configs #3

New Issue

kawaiipunk · 2020-09-15T10:50:37Z

kawaiipunk commented

2020-09-15 10:50:37 +00:00

Currently our SSL Labs certs are only getting a B:

https://www.ssllabs.com/ssltest/analyze.html?d=autonomic.zone&hideResults=on
https://www.ssllabs.com/ssltest/analyze.html?d=git.autonomic.zone&hideResults=on

The two main issues are:

This server does not support Forward Secrecy with the reference browsers. Grade capped to B. MORE INFO »
This server supports TLS 1.0 and TLS 1.1. Grade capped to B.

We should add config options for improved security. Here is the Traefik docs. I feel like that page is missing details though.

We may need to look at other documentation. There are numerous blogposts.

Mozilla has some good guides too.

This is probablly what we want to be going by:
https://ssl-config.mozilla.org/#server=traefik&version=2.1.2&config=modern&guideline=5.6

Or intermediate to ensure compat with older clients:
https://ssl-config.mozilla.org/#server=traefik&version=2.1.2&config=intermediate&guideline=5.6

Currently our SSL Labs certs are only getting a B: https://www.ssllabs.com/ssltest/analyze.html?d=autonomic.zone&hideResults=on https://www.ssllabs.com/ssltest/analyze.html?d=git.autonomic.zone&hideResults=on The two main issues are: - This server does not support Forward Secrecy with the reference browsers. Grade capped to B. MORE INFO » - This server supports TLS 1.0 and TLS 1.1. Grade capped to B. We should add config options for improved security. Here is the [Traefik docs](https://docs.traefik.io/https/tls/). I feel like that page is missing details though. We may need to look at [other documentation](https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices). There are [numerous blogposts](https://tferdinand.net/en/traefik-2-tls-configuration/). Mozilla has some [good guides](https://wiki.mozilla.org/Security/Server_Side_TLS) too. This is probablly what we want to be going by: https://ssl-config.mozilla.org/#server=traefik&version=2.1.2&config=modern&guideline=5.6 Or intermediate to ensure compat with older clients: https://ssl-config.mozilla.org/#server=traefik&version=2.1.2&config=intermediate&guideline=5.6

❤️ 1 🎉 1

3wordchant referenced this issue

2020-09-24 21:39:48 +00:00

Sunset this repo in favour of compose-stacks/traefik & coop-cloud-apps #5

3wordchant commented

2020-09-29 22:59:22 +00:00

Migrated to compose-stacks/traefik#4

3wordchant closed this issue

2020-09-29 22:59:23 +00:00

This repo is archived. You cannot comment on issues.