4 ms·
I think something to understand here is that SSL Labs wants you to aim for A+, not for 100%. The numeric score is probably just to visualize what areas need imp
by FiloSottile 10y ago
I think something to understand here is that SSL Labs wants you to aim for A+, not for 100%. The numeric score is probably just to visualize what areas need improvement, and obviously 256 scores more than 128, but that's not an indictment of 128.
This article in a nice exercise, but not a guide you should follow in production. The HTTP/2 ciphersuites recommendations are great, and there's no security reason to disregard them.
- MrPeterLambert 10y agoAuthor here. This is exactly right. I even go as far to say: > You should probably stop here. Continuing to attempt to achieve a perfect score will result in reduced client compatibility. This means that many users will not be able to access your site. I should probably have also said that it is unlikely to be their intentions. An A+ is more than good enough. This was just an exercise to better understand how to influence the score with a Go server as I've read a few in the past for NGINX, Apache etc. Aiming for 100% in all ares was just a fun, but mostly pointless metric. It did, however uncover a couple of interesting things along the way.
- ivanr 10y agoThat's absolutely correct; the goal should be to get an A+. (SSL Labs author.)