3 ms·
1) Strength - always at least 2048 bits, 4096 if speed isn't as critical as security. For your CSR make sure you use SHA256 for signing (http://itigloo.com/secu
by 4oo4 11y ago
1) Strength - always at least 2048 bits, 4096 if speed isn't as critical as security. For your CSR make sure you use SHA256 for signing (http://itigloo.com/security/generate-an-openssl-certificate-request-with-sha-256-signature/ http://itigloo.com/security/generate-an-openssl-certificate-...)
As for ciphers, depends on the tradeoff you need for compatibility vs. security; I would consult Mozilla:
https://wiki.mozilla.org/Security/Server_Side_TLS https://wiki.mozilla.org/Security/Server_Side_TLS
They also have a handy config generator, depending on what server you're going to use:
https://mozilla.github.io/server-side-tls/ssl-config-generator/ https://mozilla.github.io/server-side-tls/ssl-config-generat...
2) For lowest cost and no bullshit, I'd go with CertSimple (https://certsimple.com https://certsimple.com), or DigiCert (https://digicert.com https://digicert.com).
3) As mentioned below, SSLLabs will point out if any of your config is risky. Besides that, you might want to add a 301 URL redirect to your web server to force people to only use SSL and avoid the fatal mistake of someone forgetting to type http_s_.
Have fun!
- ryan-c 11y agoI don't think it matters whether you use SHA1 or SHA256 on your CSR - a CA can issue you a SHA256 certificate regardless. Better to use SHA256 on the CSR, of course, but not worth worrying about.
- bobwaycott 11y agothanks for a great reply on all points.
- junto 11y agoBesides that, you might want to add a 301 URL redirect to your web server to force people to only use SSL and avoid the fatal mistake of someone forgetting to type http_s Is there any other way to do this. If a user makes a non SSL request to my server they have potentially already leaked information in that request, especially if it is a post. Cookies etc are all exposed. Is there a best practice to prevent users making this first incorrect request in the first place?
- staunch 11y agoUsing HSTS and browsers pre-loaded list of sites that are HTTPS-only prevents leakage: https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security Also cookies also have a 'secure' flag.
- NeutronBoy 11y ago> Besides that, you might want to add a 301 URL redirect to your web server to force people to only use SSL and avoid the fatal mistake of someone forgetting to type http_s_. Is there any advantage of this over doing it at a DNS level?
- Revell 11y agoCertSimple and DigiCert seem to be a bit pricey for simple DV (Domain Verification) certificates, any other options in that area?