mozilla / ssl-config-generator

Mozilla SSL Configuration Generator
https://ssl-config.mozilla.org/
Mozilla Public License 2.0
358 stars 59 forks source link

Reusability improvements #57

Closed JGoutin closed 4 years ago

JGoutin commented 5 years ago

Hello,

After, #35, I decided to implement a Python + CLI version of this awesome SSL generator to be able to generate configuration locally easily and in a scriptable way. The generator can be found here and work well (I currently successfully generate the same configuration files as the Javascript generator).

When implementing this new utility. I found some ideas to improve the original one to make it more reusable by third parties:

If you agree with this, I can do some PR to implement this.

Also, a question: Is there a way to run npm run watch without open the browser ? I use this command to start the server in test to compare generated outputs, and the browser is not used or may be missing in the CI case.

april commented 5 years ago
JGoutin commented 5 years ago

The first thing probably isn't impossible, but would make some things difficult, e.g. noSupportedVersion

In the python code, I convert the config.js as JSON and replace noSupporterVersion by null. Then, in the state.js equivalent, I handle theses null values when selecting the max supported TLS version. That work good in my case and should be reproducible in javascript.

The trick with this is that I'm not sure I want to increase the size of every template for something that would be used only a fraction of the time. It's also pretty tricky in that presumably you would want to have more than one place to insert user config? Or maybe that's not true?

I guess I don't need more than one variable per template (And, this may not be relevant at all for some server software). In the beginning I am mainly interested by web servers. A single value in the HTTPS server/virtual host part should be sufficient to add almost any site specific config and some extra security headers.

JGoutin commented 4 years ago

I close this issue and cancel my requests for following reasons: