In a similar spirit there is also a site to scan security headers of any site [1] and another to verify the TLS settings from the Mozilla SSL Configuration Generator [2] and a git repo with code to scan sites from the command line [3] useful if the site is not reachable on the internet or automated scans to HTML reports.
I needed to perform scans internally, and testssl.sh was too slow (minimum 20 seconds with parallelization and all optional scans disabled). So I made my own scanner, for a 60-100x speedup: https://github.com/boppreh/hello_tls . It doesn't do vulnerability assessment, but I was more interested in extracting the configuration.
We also it at my work, where it's used both for mass scans of internal hosts, and scanning the same host many times during incidents/configuration changes.
And the 20s is extra annoying because it's completely unnecessary. The tool is so slow because it's thousands of lines of pure bash, manipulating individual bytes. And because it's bash, it also breaks in confusing ways when you look at it wrong[1].
Honestly, i disagree with the security headers one. Various security headers do different things and should not be applied blindly. While some are always appropriate there are also some that make sense to skip depending on what specificly your site is doing.
Not to mention, when i looked at the hall of fame entries, most had a CSP header, but it was a useless CSP header that was meaningless. It doesn't seem to distinguish between having the header and actually using it correctly.
This was always my pet peeve when working as a penetration tester. We'd run simple tools like this to cover the basics, but so many coworkers would blindly copy paste the issues without considering the site's context and suitability. Not to knock their skills, they'd find real vulnerabilities too. It's just that this stuff was considered beneath them, while I felt that giving a client tailored advice on little details like this is what they were looking for and shows attention to detail.
As a security conscious dev that has worked in various highly regulated spaces I want to say we really appreciate people like you, because they’re super rare
It's seriously infuriating receiving these "Critical vulnerability reports" customers let other agencies do, and having to justify why you have no Referer-Policy header.
Nice to read that you are reasonable.
Also, they want a strict CSP while serving 10 different ad networks :)
When doing this, you see that some people feel that you are being pedantic.
And the biggest issue is that it creates confusion.
During calls with customers, when I tell that we're going to setup their TLS certs, they reply, worried: "no, we need SSL certs!".
I see it as another chicken & egg situation: regular people don't know about TLS, and business are afraid of communicating about TLS because they don't want their customer going elsewhere because they don't understand what TLS is and want SSL
There are no TLS certs, it's x509 certs :) SSL certificate is still the name used by everybody though. For the protocol, TLS is correct (apart from SSLv3 which is very deprecated).
actually we wrote this many years ago and left mozilla ans nobody is really updating it other than adding new configs. its not super useful anymore :)
at the time it made sense to us because you couldnt have good SSL configuration everywhere (it was not well supported) so we had trade-offs and created tiers of configs. We barely had TLS coming out, so SSL eas still the name of the game.
nowaday just use the latest TLS defaults and you're golden.
Back in the day, SSL didn't exists. When it came into existence, it was quite an expensive novelty.
It became a generic name that everyone knew for encrypted HTTP connections. It still is a generic name for that, even though the underlying protocol changed name to TLS.
The main answer is a lot of the software on that page predates SSLs deprecation and people (sysadmins especially, because they wrote some bash script 20 years ago and want it to keep working) like backwards compatibility.
We do or will until Certificate lifespan changes. We have customers cert pinning our API cert at work (shitty Enterprise security practices) so constant 60 days rotation with LE or ZeroSSL caused endless support heartache because these enterprise customers demanded we tell them when and what new fingerprint was.
So, 1-year certs and renew 60 days out, send out new fingerprint and at 30 days, we would occasionally swap it in and out as brownout with replacement at 15 days.
We have already indicated when it drops to 100 days, we will swap to automation and no longer communicate when changes will occur. Account Managers are already getting push back from customers. It's possible we will continue using Digicert because they seem to promise that Intermediate certs won't rotate unlike Let's Encrypt which rotates them more frequently which is better security practice. So Enterprise customers will cert pin to Intermediate instead.
Lots of people, I certainly don't trust free providers, and I think it's a lot less likely that malware will use a non-free cert, so some people trust those more. Plus there are email, code-signing and other cert types that aren't provided for free.
What does this mean in practice? Do you remove the free providers from your OS & browser trust stores? Does this mean you get warnings every time you visit a site that uses LetsEncrypt (and other free providers)?
In what way is a non-profit such as Lets Encrypt attempting to monetize their customer relationships? They've issued more 700 million certificates at no cost.
While I don't get the cynicism in this case, you would agree supporting a secure web is in the public interest, right?
Lol!! I'll donate $100k to charity if they disabled the LE root. But of course they didn't. Because they're ignorantly babbling about a topic they have no idea about.
To each their own, but you do realize that you are using a free website running on free software secured by free TLS libraries transmitted via routers that often run free software and firmware? Also how much did you pay for the browser you used to make these comments?
There is a sea of difference between something like Google/Facebook/TikTok and Let’s Encrypt/the Linux Foundation/FSF/etc. I can only assume you can’t see that difference if you have spent no time reading about these things, but I would encourage you to. This stuff is important especially if you get to make security decisions for any kind of product.
I think this concern is reflects a misunderstanding of how the security of the WebPKI works. Specifically, any CA can issue certificates for your domain whether you are their customer or not. What that means is that if CA #1 is compromised but you choose CA #2, CA #1 can still be used to attack connections to your domain.
The situation is slightly worse if the CA you actually use is compromised because the main defense we have against misissuance is Certificate Transparency, and it's easier to detect that a certificate was issued by a CA you don't use than that too many certificates were issued by a CA you do use, but it's just slightly easier.
The bottom line here is that if you are worried about some group of CAs being compromised, then using a different CA doesn't help you much.
> Yes I understand all of that, but I still choose to trust free services less.
Well, you can choose to do whatever you want, but given that you're posting to a public forum, it would be helpful if you actually explained your reasoning.
> Of course the (more secure?) alternative would be to generate self-signed certs, but for customer-facing sites that's a big UX problem.
It's not just a big UX problem, it's a big security problem, because the customers have no way of knowing if your certificate is actually valid.
> it would be helpful if you actually explained your reasoning.
It's exceedingly clear that's not going to happen, and I think we all know why. Good reminder to anyone that anyone can just post here. Including people that logic-lessly think that paying a shitty third party that probably has a bad track record is somehow better than using LE. Like, this isn't a serious conversation?
I would have that concern, at minimum 100x more with random shitty unreliable SSL providers, than those being run by literal huge nerds and non-profits. Your analysis here is thin and lazy and that's being generous to your analysis.
The name was changed from SSL to TLS as part of the adoption in IETF. I imagine different people had different motivations, but in part it was a signal that it was going to be controlled by IETF rather than Netscape.
As far as compatibility goes, TLS is backward compatible with SSLv3 [0] in that the client can send a ClientHello that is acceptable to both SSLv3 and TLS servers and the server can select the version to use.
Re: the version number, we're now on TLS 1.3, so I guess that would be SSLv7.
[0] The situation is more complicated with SSLv2, which had a different ClientHello format.
I did this recently then put it in my Tupperware (which most people have never seen or used since it was only sold at those at home Tupperware parties and not at stores).
ElGamal says he uses them interchangeably. He says TLS exists for historical reasons, but the essence of the technology is the same. I got into the habit of using SSL/TLS.
I had to double check my nginx configuration and the variables use SSL in the names even though I define the protocol to be TLS. I have the certbot commands and their naming conventions use SSL. Perhaps you've never actually implemented SSL or TLS and just use the latest tech jargon to fake understanding?
Not only is it difficult to make an informed choice, it also incurs a maintenance cost. Cost which is often not paid, resulting in configuration that becomes increasingly sub-optimal as time passes and the SSL/TLS library is updated.
I'm fairly certain that when that generator was made (or article written), OpenSSL and similar already had ciphersuite presets one could use. So it is a bit odd that the generator is not enhancing those.
As an example, in the case of OpenSSL you can combine presets such as "HIGH" with your additional preferences. Such as avoiding non-PFS key exchanges, DoS risks, SHA1 phase out or less frequently used block ciphers. Result being something like "HIGH:!kRSA:!kEDH:!SHA1:!CAMELLIA:!ARIA". Optionally one can also bump up global "SECLEVEL" in OpenSSL's configuration.
Such a combination helps avoid issues like accidentally crippling operations when an ECC key(/cert) is used and someone forgot to allow ECDHE+ECDSA in addition to ECDHE+RSA. Nor does it accidentally disable strong ciphersuites using ChaCha20 that aren't as old.
Same goes for key exchange configuration. Quite a few servers don't have EdDSA available that don't run Windows, I suspect it's because they were set at some point and forgotten. Now such configuration also disables post-quantum hybrid key exchange algorithms.
Feels like server developers should include turnkey configurations where you just give maybe a year/quarter and compatibility target (secure, medium, loose).
Needing to cha-cha your salsas, 128 to the 256 to the 1305...picking SSL ciphers is the biggest cargo-cult thing ever. I have no clue what I am doing.
Same reason they recommend the similar directive for nginx:
> all the ciphers in Modern and Intermediate are secure. As such, we let the client choose the most performant cipher suite for their hardware configuration.
The choice between ChaCha20 and AES can be left to the clients with the "PrioritizeChaCha" option. On both OpenSSL and BoringSSL, likely similar options are available with other libraries as well. Anything else such as not enforcing any preference is unnecessary.
This has been around for a long time. Kudos to the folks that built it. It served a need at the time and made a big impact on improving configurations for people that didn't understand the myriad of ways to setup ssl/tls.
This looks like something that's been around forever, but it's the first time I've seen it. xkcd://{{derive_from_context}}
It's a great idea. I've created (or copied) at least half of these output formats, a few of which I remember being annoyingly difficult to surface from the project docs.
But in the moment today, it's mostly interesting to see the different ways of saying the same things in various configuration languages. And thinking that this might be why so many people with different brains find the technology world so obtuse and off-putting.
The joke's on them, of course. We like it this way! (Never wrestle with a pig...)
How do these configs differ to server defaults? If some really bad settings are enabled by default (thus needing this custom config), shouldn't it be better just to have the server-software devs fix the defaults to be 'good enough' (for most)?
It does, but every time you click on a new option it's a new URL. So if you poke around a bit, you may have generated dozens of entries in the history.
[1] - https://securityheaders.com/
[2] - https://www.ssllabs.com/ssltest/
[3] - https://github.com/testssl/testssl.sh
And the 20s is extra annoying because it's completely unnecessary. The tool is so slow because it's thousands of lines of pure bash, manipulating individual bytes. And because it's bash, it also breaks in confusing ways when you look at it wrong[1].
[1] https://github.com/testssl/testssl.sh/pull/2429
Not to mention, when i looked at the hall of fame entries, most had a CSP header, but it was a useless CSP header that was meaningless. It doesn't seem to distinguish between having the header and actually using it correctly.
Nice to read that you are reasonable.
Also, they want a strict CSP while serving 10 different ad networks :)
When doing this, you see that some people feel that you are being pedantic.
And the biggest issue is that it creates confusion. During calls with customers, when I tell that we're going to setup their TLS certs, they reply, worried: "no, we need SSL certs!".
I see it as another chicken & egg situation: regular people don't know about TLS, and business are afraid of communicating about TLS because they don't want their customer going elsewhere because they don't understand what TLS is and want SSL
I went on Cloudflare to try and illustrate this, and it's... complicated https://www.cloudflare.com/application-services/products/ssl...
The path says SSL but most of the page it about TLS, unless sometimes it's SSL...
"They've" been at it from the beginning, so it somehow seems understandable that Mozilla has a lot of "SSL" momentum or carryover.
at the time it made sense to us because you couldnt have good SSL configuration everywhere (it was not well supported) so we had trade-offs and created tiers of configs. We barely had TLS coming out, so SSL eas still the name of the game.
nowaday just use the latest TLS defaults and you're golden.
It became a generic name that everyone knew for encrypted HTTP connections. It still is a generic name for that, even though the underlying protocol changed name to TLS.
So, 1-year certs and renew 60 days out, send out new fingerprint and at 30 days, we would occasionally swap it in and out as brownout with replacement at 15 days.
We have already indicated when it drops to 100 days, we will swap to automation and no longer communicate when changes will occur. Account Managers are already getting push back from customers. It's possible we will continue using Digicert because they seem to promise that Intermediate certs won't rotate unlike Let's Encrypt which rotates them more frequently which is better security practice. So Enterprise customers will cert pin to Intermediate instead.
What does this mean in practice? Do you remove the free providers from your OS & browser trust stores? Does this mean you get warnings every time you visit a site that uses LetsEncrypt (and other free providers)?
[1]: https://sslmate.com/resources/certificate_authority_failures
While I don't get the cynicism in this case, you would agree supporting a secure web is in the public interest, right?
There is a sea of difference between something like Google/Facebook/TikTok and Let’s Encrypt/the Linux Foundation/FSF/etc. I can only assume you can’t see that difference if you have spent no time reading about these things, but I would encourage you to. This stuff is important especially if you get to make security decisions for any kind of product.
I think this concern is reflects a misunderstanding of how the security of the WebPKI works. Specifically, any CA can issue certificates for your domain whether you are their customer or not. What that means is that if CA #1 is compromised but you choose CA #2, CA #1 can still be used to attack connections to your domain.
The situation is slightly worse if the CA you actually use is compromised because the main defense we have against misissuance is Certificate Transparency, and it's easier to detect that a certificate was issued by a CA you don't use than that too many certificates were issued by a CA you do use, but it's just slightly easier.
The bottom line here is that if you are worried about some group of CAs being compromised, then using a different CA doesn't help you much.
Of course the (more secure?) alternative would be to generate self-signed certs, but for customer-facing sites that's a big UX problem.
Well, you can choose to do whatever you want, but given that you're posting to a public forum, it would be helpful if you actually explained your reasoning.
> Of course the (more secure?) alternative would be to generate self-signed certs, but for customer-facing sites that's a big UX problem.
It's not just a big UX problem, it's a big security problem, because the customers have no way of knowing if your certificate is actually valid.
It's exceedingly clear that's not going to happen, and I think we all know why. Good reminder to anyone that anyone can just post here. Including people that logic-lessly think that paying a shitty third party that probably has a bad track record is somehow better than using LE. Like, this isn't a serious conversation?
"Somehow" is doing a lot work in that sentence.
Operationally, there's no difference between the security procedures and requirements that a for-profit or a non-profit CA must adhere to.
The name was changed from SSL to TLS as part of the adoption in IETF. I imagine different people had different motivations, but in part it was a signal that it was going to be controlled by IETF rather than Netscape.
As far as compatibility goes, TLS is backward compatible with SSLv3 [0] in that the client can send a ClientHello that is acceptable to both SSLv3 and TLS servers and the server can select the version to use.
Re: the version number, we're now on TLS 1.3, so I guess that would be SSLv7.
[0] The situation is more complicated with SSLv2, which had a different ClientHello format.
I think xerox still exits but darn if I haven’t seen one in ages.
Xerox -> Fuji-Xerox -> FUJIFILM Business Innovation
https://news.ycombinator.com/item?id=44282378
https://www.fortinet.com/resources/cyberglossary/ssl-vpn
> The Mozilla SSL Configuration Generator is great, and it should not exist.
I'm fairly certain that when that generator was made (or article written), OpenSSL and similar already had ciphersuite presets one could use. So it is a bit odd that the generator is not enhancing those.
As an example, in the case of OpenSSL you can combine presets such as "HIGH" with your additional preferences. Such as avoiding non-PFS key exchanges, DoS risks, SHA1 phase out or less frequently used block ciphers. Result being something like "HIGH:!kRSA:!kEDH:!SHA1:!CAMELLIA:!ARIA". Optionally one can also bump up global "SECLEVEL" in OpenSSL's configuration.
Such a combination helps avoid issues like accidentally crippling operations when an ECC key(/cert) is used and someone forgot to allow ECDHE+ECDSA in addition to ECDHE+RSA. Nor does it accidentally disable strong ciphersuites using ChaCha20 that aren't as old.
Same goes for key exchange configuration. Quite a few servers don't have EdDSA available that don't run Windows, I suspect it's because they were set at some point and forgotten. Now such configuration also disables post-quantum hybrid key exchange algorithms.
https://wiki.mozilla.org/Security/Server_Side_TLS
Such useful resources.
https://infosec.mozilla.org/guidelines/openssh
Needing to cha-cha your salsas, 128 to the 256 to the 1305...picking SSL ciphers is the biggest cargo-cult thing ever. I have no clue what I am doing.
> all the ciphers in Modern and Intermediate are secure. As such, we let the client choose the most performant cipher suite for their hardware configuration.
https://github.com/mozilla/server-side-tls/issues/260#issuec...
https://wiki.mozilla.org/Security/Server_Side_TLS
The choice between ChaCha20 and AES can be left to the clients with the "PrioritizeChaCha" option. On both OpenSSL and BoringSSL, likely similar options are available with other libraries as well. Anything else such as not enforcing any preference is unnecessary.
Perhaps it is too niche of a thing. Sadly. It really is quite useful in some situations.
It's a great idea. I've created (or copied) at least half of these output formats, a few of which I remember being annoyingly difficult to surface from the project docs.
But in the moment today, it's mostly interesting to see the different ways of saying the same things in various configuration languages. And thinking that this might be why so many people with different brains find the technology world so obtuse and off-putting.
The joke's on them, of course. We like it this way! (Never wrestle with a pig...)