New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

New default TLS options #216

Open

bigben93 opened this issue Aug 23, 2023 · 1 comment · May be fixed by #217

bigben93 commented Aug 23, 2023 •

edited

Loading

I tested default settings of lua-http server with testssl command.
The worst problems:

Testing protocols via sockets except NPN+ALPN

SSLv2 not offered (OK)
SSLv3 not offered (OK)
TLS 1 offered (deprecated)
TLS 1.1 offered (deprecated)
TLS 1.2 offered (OK)
TLS 1.3 offered (OK): final
NPN/SPDY not offered
ALPN/HTTP2 h2, http/1.1 (offered)

and

Testing vulnerabilities
[...]
Secure Client-Initiated Renegotiation VULNERABLE (NOT ok), DoS threat
[...]

To fix these problems HTTPS server must be run with additional TLS flags: OP_NO_TLSv1, OP_NO_TLSv1_1, OP_NO_RENEGOTIATION.

I think it would be a good idea to provide better security "out of the box".

daurnimator linked a pull request

that will close this issue

http/tls: update to new mozilla recommendations #217

Open

Owner

daurnimator commented Aug 28, 2023

See #217

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment