3 ms·

Here is my Nginx config for let's encrypt on my case, feel free to criticize or copy it: https://gist.github.com/alex-min/158f35f604b24e163ae9 https://gist.gith

Here is my Nginx config for let's encrypt on my case, feel free to criticize or copy it: https://gist.github.com/alex-min/158f35f604b24e163ae9 https://gist.github.com/alex-min/158f35f604b24e163ae9. I've managed to get a A+ on the ssllab test so it should not be too bad I believe (but I'm not an expert so if you have some idea for improvements, I would be glad).

majewsky 11y ago
Here is my configuration: https://github.com/majewsky/system-configuration/blob/master/hologram-nginx-and-letsencrypt.pkg.toml https://github.com/majewsky/system-configuration/blob/master... Domains with this configuration get A+ on ssllabs and securityheaders.io (test with "repo.holocm.org" if you like). It includes an autorenewal script wrapped in a systemd timer unit. There is one bug, though: The autorenewal script fails because letsencrypt crashes when stdin is not a TTY. ( https://github.com/letsencrypt/letsencrypt/issues/2523 https://github.com/letsencrypt/letsencrypt/issues/2523 )
nickik 11y ago
You should also add HPKP (leaf pinning), it insanly powerful and a challange to get right. I have not figured out why the damn ssllabs complains about it to me.
- realusername 11y ago
  I wanted to add it but I've seen all these warnings on the Internet about it and I'm not so sure I will be able to manage it if it does not work as expected. I've added X-Frame-Options, Strict-Transport-Security, X-Xss-Protection and X-Content-Type-Options because they have very few side-effects but I'm a bit afraid of HPKP.
- tombrossman 11y ago
  I have the same problem, if I use one of the HPKP generators (or copy-paste a 'correct' example & substitute my cert hashes) I always get the SSL Labs error. Everything else is perfect. Depending on what guide I follow, I get Nginx errors, SSL Labs errors, or other third-party test errors. Never a consensus, which is what I would expect once everything is 100% correct. I'll have to set aside a few more hours to figure this out soon. Even good documentation like this is not working for me: https://developer.mozilla.org/en-US/docs/Web/Security/Public_Key_Pinning https://developer.mozilla.org/en-US/docs/Web/Security/Public...

majewsky 11y ago

Here is my configuration: https://github.com/majewsky/system-configuration/blob/master/hologram-nginx-and-letsencrypt.pkg.toml https://github.com/majewsky/system-configuration/blob/master... Domains with this configuration get A+ on ssllabs and securityheaders.io (test with "repo.holocm.org" if you like). It includes an autorenewal script wrapped in a systemd timer unit. There is one bug, though: The autorenewal script fails because letsencrypt crashes when stdin is not a TTY. ( https://github.com/letsencrypt/letsencrypt/issues/2523 https://github.com/letsencrypt/letsencrypt/issues/2523 )

nickik 11y ago

You should also add HPKP (leaf pinning), it insanly powerful and a challange to get right. I have not figured out why the damn ssllabs complains about it to me.

realusername 11y ago
I wanted to add it but I've seen all these warnings on the Internet about it and I'm not so sure I will be able to manage it if it does not work as expected. I've added X-Frame-Options, Strict-Transport-Security, X-Xss-Protection and X-Content-Type-Options because they have very few side-effects but I'm a bit afraid of HPKP.
tombrossman 11y ago
I have the same problem, if I use one of the HPKP generators (or copy-paste a 'correct' example & substitute my cert hashes) I always get the SSL Labs error. Everything else is perfect. Depending on what guide I follow, I get Nginx errors, SSL Labs errors, or other third-party test errors. Never a consensus, which is what I would expect once everything is 100% correct. I'll have to set aside a few more hours to figure this out soon. Even good documentation like this is not working for me: https://developer.mozilla.org/en-US/docs/Web/Security/Public_Key_Pinning https://developer.mozilla.org/en-US/docs/Web/Security/Public...