3 ms·

Thanks! But actually, it pains me that we're still showing a SHA-1 cert. Because bureaucracy, we're still waiting on a replacement SHA-2 cert, which once insta

Thanks! But actually, it pains me that we're still showing a SHA-1 cert. Because bureaucracy, we're still waiting on a replacement SHA-2 cert, which once installed will bring our score up to an A+ like this: https://www.ssllabs.com/ssltest/analyze.html?d=staging.18f.us https://www.ssllabs.com/ssltest/analyze.html?d=staging.18f.u... We're changing up processes internally that will speed things up. The subject of a future post! EDIT: And yeah, we're aware of the notalone.gov issues. There's some legacy infrastructure there, but we'll try to get it fixed up. Our future sites will be stronger.

jvehent 12y ago
Do you have to maintain backward compatibility with Windows XP pre-SP3 for gov sites? That would require SHA-1 certs and SSLv3.
- acdha 12y ago
  I don't know about 18F's perspective but most of the places I've heard about upgraded off of XP rather than deal with it not being supported (waivers aren't a given, require work and paid support hits already-tight budgets). Not even installing SP3 would be even harder to justify and that's one of the areas where the increased security panic is actually useful.
  - yuhong 12y ago
    Yea, MS does offer custom support for older service packs too but it has been years since XP SP2 left support.
  - konklone 12y ago
    Every site is going to have a different sort of userbase, so it's tough to make sweeping proclamations about support. I don't think we'll have trouble using SHA-2 in our deployments.
    - acdha 12y ago
      Yeah, I'm sure there are exceptions lurking around – the world is too big not to be – but I'd also be surprised if those lingering remnants were in widespread, internet-facing use.