1. Heartbleed Aftermath

Fortunately HCoop wasn't hit by the OpenSSL Heartbleed bug. However this perhaps is an opportunity for some spring clean up.

These reports do not look good:

(Warning: their analyzer may need to run, and you might need to wait a while to see the actual report.)

Here's the status of navajos: it gets an F per the above SSL Labs report, because:

Server's certificate is not trusted. Grade set to F.
Server supports only older protocols, but not the current best TLS 1.2. Grade capped to B.
Server does not support Forward Secrecy with the reference browsers.

Deleuze is particularly problematic, because:

Server's certificate is not trusted. Grade set to F.
Server supports SSL 2, which is obsolete and insecure. Grade set to F.
Server is vulnerable to MITM attacks because it supports insecure renegotiation. Grade set to F.
Server does not mitigate the CRIME attack. Grade capped to B.
Server supports only older protocols, but not the current best TLS 1.2. Grade capped to B.
There is no support for secure renegotiation.
Server does not support Forward Secrecy with the reference browsers.

Since deleuze is scheduled to be decommissioned, we might want to focus on the remaining problems.

== CA Certification ==

These are the choices at the moment, to solve the immediate problem in an inexpensive manner: