3 ms·

If you're not using Mozilla's SSL config generator, you should check it out. The Mozilla OpSec team did a nice job on this. I love when teams give back to the c

• teddyh 11y ago
  It is pretty good, but it’s not an “SSL” config generator; it’s an “OpenSSL” config generator. It only supports OpenSSL. No GnuTLS, no NSS, nothing but OpenSSL.
  • nailer 11y ago
    Specifically it's for Apache/Nginx/HAProxy/AWS ELB which link against openssl (there's also a node port). Are there alternate bindings for any of these for GnuTLS, NSS, etc?
    • deptadapt 11y ago
      For Apache there are https://mod.gnutls.org/ https://mod.gnutls.org/ and https://fedorahosted.org/mod_nss/ https://fedorahosted.org/mod_nss/ I was using mod_gnutls for some sites, but it did not make it into Debian Jessie. mod_nss is still in Debian Stable though.
      • teddyh 11y ago
        Note: mod_gnutls is present in Debian unstable, and it is possible to backport it to Debian stable: dget --build http://ftp.debian.org/debian/pool/main/m/mod-gnutls/mod-gnutls_0.6-1.4.dsc You will likely get some error about “Unmet build dependencies”. If you do; run this: mk-build-deps --install --remove mod-gnutls_0.6-1.4.dsc and try the dget command again. Then install the package: sudo dpkg --install libapache2-mod-gnutls_0.6-1.4_$(dpkg-architecture -qDEB_HOST_ARCH).deb