4 ms·

And they do HTTPS right (at least on 18f.gsa.gov) - it's pretty rare to see an HTTPS site get an "A" grade from Qualys' SSL server test. No weak ciphers support

by mrb 12y ago

And they do HTTPS right (at least on 18f.gsa.gov) - it's pretty rare to see an HTTPS site get an "A" grade from Qualys' SSL server test. No weak ciphers supported, no support for SSL v2/v3 (only newer TLS), most ciphers support PFS, etc: https://www.ssllabs.com/ssltest/analyze.html?d=18f.gsa.gov https://www.ssllabs.com/ssltest/analyze.html?d=18f.gsa.gov Edit: not all their sites are doing HTTPS right :-/ 18F developed https://www.notalone.gov https://www.notalone.gov and this site has quite a few security issues: https://www.ssllabs.com/ssltest/analyze.html?d=notalone.gov&s=96.127.46.172 https://www.ssllabs.com/ssltest/analyze.html?d=notalone.gov&...

konklone 12y ago
Thanks! But actually, it pains me that we're still showing a SHA-1 cert. Because bureaucracy, we're still waiting on a replacement SHA-2 cert, which once installed will bring our score up to an A+ like this: https://www.ssllabs.com/ssltest/analyze.html?d=staging.18f.us https://www.ssllabs.com/ssltest/analyze.html?d=staging.18f.u... We're changing up processes internally that will speed things up. The subject of a future post! EDIT: And yeah, we're aware of the notalone.gov issues. There's some legacy infrastructure there, but we'll try to get it fixed up. Our future sites will be stronger.
- jvehent 12y ago
  Do you have to maintain backward compatibility with Windows XP pre-SP3 for gov sites? That would require SHA-1 certs and SSLv3.
  - acdha 12y ago
    I don't know about 18F's perspective but most of the places I've heard about upgraded off of XP rather than deal with it not being supported (waivers aren't a given, require work and paid support hits already-tight budgets). Not even installing SP3 would be even harder to justify and that's one of the areas where the increased security panic is actually useful.
    - yuhong 12y ago
      Yea, MS does offer custom support for older service packs too but it has been years since XP SP2 left support.
    - konklone 12y ago
      Every site is going to have a different sort of userbase, so it's tough to make sweeping proclamations about support. I don't think we'll have trouble using SHA-2 in our deployments.
      - acdha 12y ago
        Yeah, I'm sure there are exceptions lurking around – the world is too big not to be – but I'd also be surprised if those lingering remnants were in widespread, internet-facing use.

by mrb 12y ago

konklone 12y ago

Thanks! But actually, it pains me that we're still showing a SHA-1 cert. Because bureaucracy, we're still waiting on a replacement SHA-2 cert, which once installed will bring our score up to an A+ like this: https://www.ssllabs.com/ssltest/analyze.html?d=staging.18f.us https://www.ssllabs.com/ssltest/analyze.html?d=staging.18f.u... We're changing up processes internally that will speed things up. The subject of a future post! EDIT: And yeah, we're aware of the notalone.gov issues. There's some legacy infrastructure there, but we'll try to get it fixed up. Our future sites will be stronger.

jvehent 12y ago
Do you have to maintain backward compatibility with Windows XP pre-SP3 for gov sites? That would require SHA-1 certs and SSLv3.
- acdha 12y ago
  I don't know about 18F's perspective but most of the places I've heard about upgraded off of XP rather than deal with it not being supported (waivers aren't a given, require work and paid support hits already-tight budgets). Not even installing SP3 would be even harder to justify and that's one of the areas where the increased security panic is actually useful.
  - yuhong 12y ago
    Yea, MS does offer custom support for older service packs too but it has been years since XP SP2 left support.
  - konklone 12y ago
    Every site is going to have a different sort of userbase, so it's tough to make sweeping proclamations about support. I don't think we'll have trouble using SHA-2 in our deployments.
    - acdha 12y ago
      Yeah, I'm sure there are exceptions lurking around – the world is too big not to be – but I'd also be surprised if those lingering remnants were in widespread, internet-facing use.