4 ms·

Cipherli.st – Strong Ciphers for Apache, Nginx and Lighttpd

55 points by josephscott 10y ago

koolba 10y ago
Here's a configurable version by Mozilla: https://mozilla.github.io/server-side-tls/ssl-config-generator/ https://mozilla.github.io/server-side-tls/ssl-config-generat...
- vsviridov 10y ago
  I like this one better, can pick versions and backwards compatibility level.
- neoCrimeLabs 10y ago
  Easier to read too, without a background image and transparency.
WhatsName 10y ago
See also: https://bettercrypto.org https://bettercrypto.org
- deleted 10y ago
  [deleted]
mdewinter 10y ago
Author here, please let me know any comments, issues or anything else. I'm also behind other projects like an SSL (site) test, a fast one: https://ssldecoder.org/ https://ssldecoder.org/ and a certificate monitoring service (reminds you before expiring): https://certificatemonitor.org/ https://certificatemonitor.org/. Also my personal site describing my adventures in *NIX and cloudland: https://raymii.org/s/ https://raymii.org/s/, plus a boatload of TLS related articles. The mozilla guide is also very good, the ability to configure based on your server settings and browser support is a heck of a nice feature. Whenever I have time to learn javascript that's the first thing to implement. Although, all my projects are open source (https://github.com/RaymiiOrg/ https://github.com/RaymiiOrg/) so merge requests are welcome. Ferm GPL believer here.
- mg794613 10y ago
  "Hier niet poepen zegmaar." I'd remove that to prevent confusion as it did with me ;)
- vtlynch 10y ago
  How often are the recommendations on cipherli.st updated?
  - mdewinter 10y ago
    Not very often, mostly when someone sends a merge request with a new piece of software (like varnish).
- AdamJacobMuller 10y ago
  One of the things I noticed was that there is no rationale listed for the ssl_session_tickets disablement. I assume your concern is something like https://www.imperialviolet.org/2013/06/27/botchingpfs.html https://www.imperialviolet.org/2013/06/27/botchingpfs.html which for most general use cases you're correct in saying that it should be disabled, but, it definitely deserves a nuanced explanation.
- rajjalan 10y ago
  Hi mdewinter, FYI, getting a cert error getting to cipherli.st
meritt 10y ago
Why is there a giant heart-shaped lock obscuring most of the screen?
- vbezhenar 10y ago
  It's very distracting and makes website hard to read.
  - asamarin 10y ago
    Agreed. After a few mins of reading, it became annoying enough that I felt an urge to remove it via dev-tools. Nice content, nonetheless.
- mdewinter 10y ago
  That was a spin on the Heartbleed theme and personally, I like it.
  - deleted 10y ago
    [deleted]
- gechr 10y ago
  Aha, I remember now. I was puzzled by what this comment meant at first. This isn't the first time I've come across this site! I recall being annoyed by this, too. Fortunately, uBlock Origin[1][2] came to my rescue back then. It's a great adblocker which requires minimal configuration out-of-the-box, but also offers a bunch of Power User options for the more discerning Internet user. One such option is a point-and-click tool[3] that allows you to block arbitrary elements loading on a given site, which I promptly used to obliterate this image on first sight. :-) [1] Chrome - https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm?hl=en https://chrome.google.com/webstore/detail/ublock-origin/cjpa... [2] Firefox - https://addons.mozilla.org/en-GB/firefox/addon/ublock-origin/ https://addons.mozilla.org/en-GB/firefox/addon/ublock-origin... [3] https://github.com/gorhill/uBlock/wiki/Element-picker https://github.com/gorhill/uBlock/wiki/Element-picker
Eun 10y ago
Posted at least 4 times. Guys please keep it clean. https://news.ycombinator.com/from?site=cipherli.st https://news.ycombinator.com/from?site=cipherli.st
- tptacek 10y ago
  Reposts are fine, especially when they haven't gotten much attention before.
snassar 10y ago
The SSL config for dovecot on Debian Jessie (2.2.13-12~deb8u1) stops Thunderbird 45 from connecting. (I did open an issue about this.)
newman314 10y ago
I know it may not be too interesting or relevant but it would be nice to have similar configurations for common/popular enterprise tools/platforms such as F5, Cisco, Juniper etc. I see so many badly configured systems as part of the day job that it certainly would be great to help start socializing good configs. PS. even for something like Tomcat (which changes features on minor versions?!?), it's hard to find good configs. I have a whole bunch of notes on things like this and happy to share if someone wants to codify it.
- mdewinter 10y ago
  If you have the config or required format for config I'd be happy to add it. Create an issue with the config,, I can do the code then

55 points by josephscott 10y ago

Here's a configurable version by Mozilla: https://mozilla.github.io/server-side-tls/ssl-config-generator/ https://mozilla.github.io/server-side-tls/ssl-config-generat...

vsviridov 10y ago
I like this one better, can pick versions and backwards compatibility level.
neoCrimeLabs 10y ago
Easier to read too, without a background image and transparency.

WhatsName 10y ago

See also: https://bettercrypto.org https://bettercrypto.org

deleted 10y ago
[deleted]

mdewinter 10y ago

Author here, please let me know any comments, issues or anything else. I'm also behind other projects like an SSL (site) test, a fast one: https://ssldecoder.org/ https://ssldecoder.org/ and a certificate monitoring service (reminds you before expiring): https://certificatemonitor.org/ https://certificatemonitor.org/. Also my personal site describing my adventures in *NIX and cloudland: https://raymii.org/s/ https://raymii.org/s/, plus a boatload of TLS related articles. The mozilla guide is also very good, the ability to configure based on your server settings and browser support is a heck of a nice feature. Whenever I have time to learn javascript that's the first thing to implement. Although, all my projects are open source (https://github.com/RaymiiOrg/ https://github.com/RaymiiOrg/) so merge requests are welcome. Ferm GPL believer here.

mg794613 10y ago
"Hier niet poepen zegmaar." I'd remove that to prevent confusion as it did with me ;)
vtlynch 10y ago
How often are the recommendations on cipherli.st updated?
- mdewinter 10y ago
  Not very often, mostly when someone sends a merge request with a new piece of software (like varnish).
AdamJacobMuller 10y ago
One of the things I noticed was that there is no rationale listed for the ssl_session_tickets disablement. I assume your concern is something like https://www.imperialviolet.org/2013/06/27/botchingpfs.html https://www.imperialviolet.org/2013/06/27/botchingpfs.html which for most general use cases you're correct in saying that it should be disabled, but, it definitely deserves a nuanced explanation.
rajjalan 10y ago
Hi mdewinter, FYI, getting a cert error getting to cipherli.st

meritt 10y ago

Why is there a giant heart-shaped lock obscuring most of the screen?

vbezhenar 10y ago
It's very distracting and makes website hard to read.
- asamarin 10y ago
  Agreed. After a few mins of reading, it became annoying enough that I felt an urge to remove it via dev-tools. Nice content, nonetheless.
mdewinter 10y ago
That was a spin on the Heartbleed theme and personally, I like it.
- deleted 10y ago
  [deleted]
gechr 10y ago
Aha, I remember now. I was puzzled by what this comment meant at first. This isn't the first time I've come across this site! I recall being annoyed by this, too. Fortunately, uBlock Origin[1][2] came to my rescue back then. It's a great adblocker which requires minimal configuration out-of-the-box, but also offers a bunch of Power User options for the more discerning Internet user. One such option is a point-and-click tool[3] that allows you to block arbitrary elements loading on a given site, which I promptly used to obliterate this image on first sight. :-) [1] Chrome - https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm?hl=en https://chrome.google.com/webstore/detail/ublock-origin/cjpa... [2] Firefox - https://addons.mozilla.org/en-GB/firefox/addon/ublock-origin/ https://addons.mozilla.org/en-GB/firefox/addon/ublock-origin... [3] https://github.com/gorhill/uBlock/wiki/Element-picker https://github.com/gorhill/uBlock/wiki/Element-picker

Eun 10y ago

Posted at least 4 times. Guys please keep it clean. https://news.ycombinator.com/from?site=cipherli.st https://news.ycombinator.com/from?site=cipherli.st

tptacek 10y ago
Reposts are fine, especially when they haven't gotten much attention before.

snassar 10y ago

The SSL config for dovecot on Debian Jessie (2.2.13-12~deb8u1) stops Thunderbird 45 from connecting. (I did open an issue about this.)

newman314 10y ago

I know it may not be too interesting or relevant but it would be nice to have similar configurations for common/popular enterprise tools/platforms such as F5, Cisco, Juniper etc. I see so many badly configured systems as part of the day job that it certainly would be great to help start socializing good configs. PS. even for something like Tomcat (which changes features on minor versions?!?), it's hard to find good configs. I have a whole bunch of notes on things like this and happy to share if someone wants to codify it.

mdewinter 10y ago
If you have the config or required format for config I'd be happy to add it. Create an issue with the config,, I can do the code then