search

mozilla / ssl-config-generator

Mozilla SSL Configuration Generator
https://ssl-config.mozilla.org/
Mozilla Public License 2.0
360 stars 59 forks source link

Change supportsOcspStapling from boolean to version based #138

Open gene1wood opened 3 years ago

gene1wood commented 3 years ago

Currently supportsOcspStapling is either true or false for a given server, but for servers that initially didn't support OCSP Stapling, but then added that support at a given version (like lighttpd) neither true nor false is really true.

I suggest updating the behavior

gene1wood commented 7 months ago

This would be useful for proftpd for example.

janbrasna commented 7 months ago

@gene1wood All the "supports*"/"uses*"/"show*" bool config values have just display logic attached to them and are only used to enable or disable individual UI components in the form to the end user, whereas the actual support version test must be in the handlebars anyways. (Read: version value for enabling/disabling the input per chosen server version is a nice UX enhancement, but might need to being kept in sync with hbs conditions:/…)

The fact these bool values are only presentational is used e. g. in HSTS where set to false to disable the checkbox in configs where the HSTS is always enabled and can't be disabled — so it's merely a flag to make the UI input disabled (read only), even when there is HSTS support 🤷

I like the way how tls13 uses noSupportedVersion constant with arbitrary high version number to practically mean false in comparisons so that might be the way, incl. consuming the value to hbs for version conditional there in render (and not having to keep the same version number test for stapling support in hbs, just comparing to configs[].* value…) however — I've looked around and several bits in state.js, in form and output, rely on its bool logic and would have to be adapted to support both UI roles and version comparison logic, more like tls13 is being handled with the minver helper.