Configuration issues identified by SSL Labs

[LiberalArtist]

The SSL Labs "SSL Server Test" service (https://www.ssllabs.com/ssltest/) identifies some aspects of the Racket web server's default HTTPS configuration that should be improved. Most significantly, it says, "This server does not support Forward Secrecy with the reference browsers. Grade capped to B."

I am still looking into the situation in more detail, but I've noticed at least two differences from the configuration generated by Certbot for Apache, which SSL Labs approves of:

1. While the Racket web server supports ECDHE, it doesn't seem to prefer more secure cypher suites to less secure ones.
2. The Racket web server's default configuration doesn't seem to enable DHE. It seems like this would force clients that support DHE but not ECDHE to fall back to RSA key exchange without forward secrecy.

I'm happy to do some implementation work here, but I haven't worked with these low-level portions before. In particular, I haven't figured out how to designate preferred cypher suites with the Racket openssl module.

[LiberalArtist]

It looks like the first step is to add support to openssl for setting the SSL_OP_CIPHER_SERVER_PREFERENCE option.

While investigating this further, most sources I'm finding about SSL/TLS configuration for servers, including the one I linked to above, ultimately point to Mozila's Server Side TLS recommendations. They maintain "Modern," "Intermediate," and "Old" recommended configurations, based on what clients your server needs to support, and update them as issues (and browsers) evolve. The recommended configurations are available as JSON, both versioned and current. I think it would be a great enhancement to integrate these configurations into Racket.

These changes need to start in the racket/racket repo, but I'll leave this open to track the issue from web-server's perspective.

[jeapostrophe]

I don't know what any of those details mean, but if you want to start fiddling. This is the code you want to change: https://github.com/racket/web-server/blob/c787d7e9dcc4896f0e0673e7dbe7bdc66b71b422/web-server-lib/web-server/web-server.rkt#L65-L76 I suspect that you need to fiddle a few flags on the server context object. It is possible you'll need to expose more functions in this file: https://github.com/racket/racket/blob/master/racket/collects/openssl/mzssl.rkt

…

On Thu, Jan 3, 2019 at 1:25 PM Philip McGrath ***@***.***> wrote: The SSL Labs "SSL Server Test" service (https://www.ssllabs.com/ssltest/) identifies some aspects of the Racket web server's default HTTPS configuration that should be improved. Most significantly, it says, "This server does not support Forward Secrecy with the reference browsers. Grade capped to B." I am still looking into the situation in more detail, but I've noticed at least two differences from the configuration <https://github.com/certbot/certbot/blob/master/certbot-apache/certbot_apache/options-ssl-apache.conf> generated by Certbot for Apache, which SSL Labs approves of: 1. While the Racket web server supports ECDHE, it doesn't seem to prefer more secure cypher suites to less secure ones. 2. The Racket web server's default configuration doesn't seem to enable DHE. It seems like this would force clients that support DHE but not ECDHE to fall back to RSA key exchange without forward secrecy. I'm happy to do some implementation work here, but I haven't worked with these low-level portions before. In particular, I haven't figured out how to designate preferred cypher suites with the Racket openssl module. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#49>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAOM-pxXj1Pa-JCjfp6HM_EXSZ02ScCKks5u_ksAgaJpZM4Zojwl> .

-- -=[ Jay McCarthy http://jeapostrophe.github.io ]=- -=[ Associate Professor PLT @ CS @ UMass Lowell ]=- -=[ Moses 1:33: And worlds without number have I created; ]=-

[rmculpepper]

@LiberalArtist The following links may be relevant:

• https://wiki.openssl.org/index.php/Diffie-Hellman_parameters
• https://stackoverflow.com/questions/41356625/

To summarize: versions of openssl before 1.1.0 took multiple steps to be coaxed into doing ephemeral key exchange. You need to call ssl-server-context-enable-ecdhe! to enable ECDHE and ssl-server-context-enable-dhe! to enable DHE; see the docs. Since 1.1.0, openssl should automatically do the right thing for ECDHE (but not DHE).