Comments (6)
My opnion:
By default: Secure
i.e: min_version tls1.1
weak ciphers disabled
tls options:
tls cert key {
protocols ssl3 tlsv1 tls11 tls12
ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5
}
from caddy.
tls cert key {
protocols TLSv1 TLSv1.1 TLSv1.2
ciphers AES128-SHA AES256-SHA DES-CBC3-SHA
cache 128 #default cache capacity is 64
}
from caddy.
This is on the right track. The syntax you've proposed seems pretty good although the ciphers might be space-separated instead of colon-separated? Also, maybe the protocols could use a dot in the version, for readability? e.g. protocols ssl3 tls1.0 tls1.1 tls1.2
-- although I don't want to allow ssl3, see below.
The default behavior of Caddy must strike a good balance between compatibility and security. As such, I think we should first agree on some solid defaults. Here's what I've come up with so far.
- Session caching: Yes - this is already done thanks to your pull request
- SSLv3: No. I don't even think there's any good reason to allow a user to enable SSLv3.
- RC4: No. The RC4 ciphers are weak.
This should allow Caddy's default HTTPS configuration to score an A on SSL Labs' tests.
If we allow TLS 1.0, I don't think we should allow CBC mode ciphers with it. I need to see if TLS 1.2 is widely enough implemented in clients so that we can drop older TLS support too - at least, for default. So I think we need to do a little more research.
from caddy.
Nice @mholt !
I agree about not support SSLv3, but my concern is with freedom of choice, if for some reason I need use SSLv3, maybe for a legacy device or a test case... I think user can have this choice... maybe we change the option name to something like unsecure_SSLv3, then user need to explicitly select the choice and are advised that this option is not secure...
some statistics:
from: https://jve.linuxwall.info/blog/index.php?post/TLS_Survey (11/2014)
Supported Protocols Count Percent
-------------------------+---------+-------
SSL2 85447 18.9264
SSL2 Only 38 0.0084
SSL3 449864 99.6443
SSL3 Only 4443 0.9841
TLS1 446575 98.9158
TLS1 Only 736 0.163
TLS1.1 145266 32.1762
TLS1.1 Only 1 0.0002
TLS1.2 149921 33.2073
TLS1.2 Only 5 0.0011
TLS1.2 but not 1.1 11888 2.6332
from caddy.
💯 That's super-useful, thank you.
Okay, perhaps we can allow the user to force SSLv3 by specifying it in the protocol list, for compatibility. But with a notice in the documentation that the cipher will be removed from Caddy in a future version. (In fact, any of the ciphers or protocols are subject to removal from Caddy at any time.)
You want to draft a PR?
from caddy.
Perfect @mholt!
Sure! I'll send a PR soon as possible =]
from caddy.
Related Issues (20)
- no certificate available for <docker container ip> HOT 1
- Accommodate `Policy` Changes in `github.com/pires/go-proxyproto` HOT 3
- Question: Reverse tunneling to caddy behind a NAT HOT 2
- dynamic a resolvers being bypassed if entry is in /etc/hosts HOT 1
- [reverse_proxy] active_health check to http endpoint does not work when upstream is via ssl/tls HOT 2
- reverse_proxy handle_response not support status HOT 1
- [Question] Host modules HOT 16
- global header HOT 2
- Weird broken loop with 308 Permanent Redirect on php_fastcgi HOT 10
- How to set up a reverse proxy for a non-local host, I didn't find any relevant examples in the official documentation HOT 1
- http_redirect module prefer 307 Temporary Redirect HOT 2
- header_regexp does not behave as expected in an expression
- [feature request]reverse_proxy can setting source address for connecting upstreams
- [windows] cannot run executable found relative to current directory HOT 6
- ReverseProxy: Multiple BasicAuth queries in succession HOT 1
- Jellyfin being reverse proxied through Caddy with Cloudflare challenge is failing to playback only on LAN HOT 1
- Caddy is not throwing an error on MacOS if address is already in use HOT 1
- file transactions on .lock files HOT 5
- redir syntax and examples seem invalid in some cases HOT 2
- On demand TLS with no host matcher (or multiple wildcards) HOT 7
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from caddy.