search

SURFscz / SRAM-deploy

Deploy scripts for the SCZ
Apache License 2.0
5 stars 5 forks source link

weak tls config on demo1 #514

Closed baszoetekouw closed 4 months ago

baszoetekouw commented 6 months ago

tls 1.0 etc

mrvanes commented 4 months ago

https://www.ssllabs.com/ssltest/analyze.html?d=demo1.sram.surf.nl

baszoetekouw commented 3 months ago

More fixes in https://github.com/SURFscz/SRAM-deploy/commit/779891445bf086882cd51530678c92939c74f3e6

baszoetekouw commented 3 months ago

tested:

 Testing protocols via sockets except NPN+ALPN

 SSLv2      not offered (OK)
 SSLv3      not offered (OK)
 TLS 1      not offered
 TLS 1.1    not offered
 TLS 1.2    not offered
 TLS 1.3    offered (OK): final
 NPN/SPDY   not offered
 ALPN/HTTP2 http/1.1 (offered)

 Testing cipher categories

 NULL ciphers (no encryption)                  not offered (OK)
 Anonymous NULL Ciphers (no authentication)    not offered (OK)
 Export ciphers (w/o ADH+NULL)                 not offered (OK)
 LOW: 64 Bit + DES, RC[2,4] (w/o export)       not offered (OK)
 Triple DES Ciphers / IDEA                     not offered
 Obsolete CBC ciphers (AES, ARIA etc.)         not offered
 Strong encryption (AEAD ciphers)              offered (OK)