<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
<div class="moz-forward-container"><br>
<br>
-------- Original Message --------
<table class="moz-email-headers-table" border="0" cellpadding="0"
cellspacing="0">
<tbody>
<tr>
<th valign="BASELINE" align="RIGHT" nowrap="nowrap">Subject:
</th>
<td>recommended settings for CAcert web servers</td>
</tr>
<tr>
<th valign="BASELINE" align="RIGHT" nowrap="nowrap">Date: </th>
<td>Sat, 13 Dec 2014 11:58:37 +0100</td>
</tr>
<tr>
<th valign="BASELINE" align="RIGHT" nowrap="nowrap">From: </th>
<td>Wytze van der Raay <a class="moz-txt-link-rfc2396E" href="mailto:wytze@cacert.org"><wytze@cacert.org></a></td>
</tr>
<tr>
<th valign="BASELINE" align="RIGHT" nowrap="nowrap">Reply-To:
</th>
<td><a class="moz-txt-link-abbreviated" href="mailto:cacert-sysadm@lists.cacert.org">cacert-sysadm@lists.cacert.org</a></td>
</tr>
<tr>
<th valign="BASELINE" align="RIGHT" nowrap="nowrap">Organization:
</th>
<td>CAcert</td>
</tr>
<tr>
<th valign="BASELINE" align="RIGHT" nowrap="nowrap">To: </th>
<td>CAcert System Administrators
<a class="moz-txt-link-rfc2396E" href="mailto:cacert-sysadm@lists.cacert.org"><cacert-sysadm@lists.cacert.org></a></td>
</tr>
</tbody>
</table>
<br>
<br>
<pre>It appears that we still have some CAcert infrastructure systems running
a webserver with non-current setings with respect to SSL/TLS security.
Even though these systems are not critical for CAcert's operation, their
non-current configuration leaves a bad impression with the community
(see for example <a class="moz-txt-link-freetext" href="https://bugs.cacert.org/view.php?id=1342">https://bugs.cacert.org/view.php?id=1342</a>).
Therefore I'd like to ask all CAcert infrastructure administrators to take
a look at their webservers and see whether the SSL/TLS configuration needs
improvements. Here is what we recommend based on our experience with the
CAcert critical servers:
SSLEngine on
SSLProtocol all -SSLv2 -SSLv3
SSLHonorCipherOrder on
SSLCipherSuite kEECDH:kEDH:AESGCM:ALL:!3DES!RC4:!LOW:!EXP:!MD5:!aNULL:!eNULL
SSLCertificateFile your-certificate-file
SSLCertificateChainFile root.crt or class3.crt
SSLCertificateKeyFile your-private-key-file
Header always set Strict-Transport-Security "max-age=31536000"
If your server certificate is class 1, you should specify the root.crt
certificate file for SSLCertificateChainFile; when it is class3, you
should specify the class3.crt certificate file there.
You can easily have the quality of your server settings checked with:
<a class="moz-txt-link-freetext" href="https://www.ssllabs.com/ssltest/">https://www.ssllabs.com/ssltest/</a>
Aside from the unavoidable "trust issues" (the CAcert root certificate is
not included in the major browsers), an "A" rating should be achieved for
all our web services:
Overall Rating: T
If trust issues are ignored: A
Regards,
-- wytze
</pre>
<br>
</div>
<br>
</body>
</html>