|
⇤ ← Revision 1 as of 2014-04-18 13:33:20
Size: 1849
Comment:
|
Size: 2108
Comment:
|
| Deletions are marked like this. | Additions are marked like this. |
| Line 32: | Line 32: |
| Problem: Browsers do not trust HCoop's self-signed certificate. Potential members might be scared away by big honking browser warnings. We might want to get a "proper" CA-signed certificate; perhaps a wildcard one. But these tend to be fairly expensive. |
1. Heartbleed Aftermath
Fortunately HCoop wasn't hit by the OpenSSL Heartbleed bug. However this perhaps is an opportunity for some spring clean up.
These reports do not look good:
(Warning: their analyzer may need to run, and you might need to wait a while to see the actual report.)
Here's the status of navajos: it gets an F per the above SSL Labs report, because:
- Server's certificate is not trusted. Grade set to F.
- Server supports only older protocols, but not the current best TLS 1.2. Grade capped to B.
- Server does not support Forward Secrecy with the reference browsers.
Deleuze is particularly problematic, because:
- Server's certificate is not trusted. Grade set to F.
- Server supports SSL 2, which is obsolete and insecure. Grade set to F.
- Server is vulnerable to MITM attacks because it supports insecure renegotiation. Grade set to F.
- Server does not mitigate the CRIME attack. Grade capped to B.
- Server supports only older protocols, but not the current best TLS 1.2. Grade capped to B.
- There is no support for secure renegotiation.
- Server does not support Forward Secrecy with the reference browsers.
Since deleuze is scheduled to be decommissioned, we might want to focus on the remaining problems.
== CA Certification ==
Problem: Browsers do not trust HCoop's self-signed certificate. Potential members might be scared away by big honking browser warnings. We might want to get a "proper" CA-signed certificate; perhaps a wildcard one. But these tend to be fairly expensive.
These are the choices at the moment, to solve the immediate problem in an inexpensive manner: