3 ms·
I'm not really sure what you're asking about or commenting on here. I will, however, take the opportunity to say that I am a big fan of the SLL Labs Server Tes
by samch 12y ago
I'm not really sure what you're asking about or commenting on here. I will, however, take the opportunity to say that I am a big fan of the SLL Labs Server Test that Ivan Ristic made. With the number of SSL/TLS vulnerabilities over the past few years, it's important to ensure that secure servers stay current with best practices. This tool offers a free way to audit that.
Getting an A+ doesn't guarantee security as your application and infrastructure must all be kept current and secured. The A+, however, is intended as an indicator that your SSL/TLS is configured to provide the optimal level of security around the transport layer. If a site gets a grade of B, that doesn't necessarily make it insecure, but it does indicate that certain vulnerabilities could expose their users' data.
- Thaxll 12y agoThe problem by getting an A+ is that you are probably blocking a lot of clients from reaching your service.
- agwa 12y agoNo, that's not true. The only client with non-negligible use that you have to lock out to get an A+ is IE6 (because IE6 only supports SSLv3, at best, by default).
- jamiesonbecker 12y agoIE6 Must Die. Except for China, IE6 is used by less than 1% of the population around the world, according to Microsoft's own data: https://www.modern.ie/en-us/ie6countdown https://www.modern.ie/en-us/ie6countdown
- agwa 12y agoIndeed. Locking IE6 out to get an A/A+ on SSL Labs is totally worth it.
- jamiesonbecker 12y agoAbsolutely. If people have old hardware or OS's, they could at least switch to an older version of a better browser.