Add DH instructions to Plug.SSL #747
Conversation
lib/plug/ssl.ex
Outdated
| openssl dhparam -out dhparam.pem 4096 | ||
| On a slow machine (e.g. a cheap VPS) this may take several hours. You may want | ||
| to run the command on a stong machine and copy the file over: the file does |
|
Is there any link we can provide to developers to get further information? |
|
OWASP, which we cited for the cipher suite selection, doesn't have all that much on the topic: There are various answers on https://crypto.stackexchange.com/ but they tend to be too academic/mathematical, or outdated. Similarly, the classical paper on the subject (https://weakdh.org/imperfect-forward-secrecy-ccs15.pdf) makes interesting reading, but is probably not much practical help for most users. I feel like the docs for Plug.SSL are getting a bit unwieldy, so perhaps we should consider moving some of the background and links to a guide on Hexdocs. |
|
@voltone this looks great! I think a Plug page on SSL best practices could also be very very welcome. Starting with the basics, mentioning the HTTP 2 requirement, and then talking about Plug.SSL as a plug and finally how to configure adapters (effectively |
|
I will merge this for now and we can open up a new issue to create the page. Thanks @voltone! ❤️ 💚 💙 💛 💜 |
3 participants
See discussion in #700