[P]Delete

Software Requirements To deploy Forward Secrecy, you need to have both your web server and the underlying SSL/TLS library support Elliptic Curve cryptography. For Apache, Nginx, and OpenSSL, the following minimum versions will suffice: OpenSSL 1.0.1c+ Apache 2.4.x nginx 1.0.6+ and 1.1.0+ You will probably want to upgrade to the most recent versions wherever possible, because you don’t want to be running old and obsolete and potentially vulnerable software. You are probably aware that Linux distributions often ship modified packages. The modifications are usually improvements, but could mean feature removal in some cases. For example, Red Hat appears to have no support for Elliptic Curve crypto on their operating systems, because of  patent issues . If you’re running CentOS, for example, and wish to support Forward Secrecy, you will need to recompile the key packages to put EC support back in . (There appear to be plenty tutorials on the Web for this.) Once the correct...

To encrypt communications between you and your end users, you purchase a SSL Certificate, install it on your server, and then configure your website to use the certificate to protect these communications. The SSL connection begins when the end user’s browser reaches out to shake hands with your website. During this handshake, information regarding the ability of the browser and server are exchanged, validation occurs, and a session key that meets both the browser’s and server’s criteria is created. Once the session key is created, the rest of the conversation between the end user and your site is encrypted and thus secured. Historically, the most common method for negotiating the session key involved the RSA public-key cryptosystem. The RSA approach uses the server’s public key to protect the session key parameters created by the browser once they are sent the server. The server is able to decrypt this handshake with its corresponding private key. When you use the RSA key exchange...

Since making changes to this site to force a secure connection, I thought now would be a good time to do a security checkup. I used both the  Symantec SSL Toolbx  and  Qualys SSL Labs  site to see how well I did installing my certificate. HTTPS website security checkup results Symantec said I was in good shape against the vulnerabilities they check for, but did note that I wasn’t using a Symantec certificate (not made of money, you know) Symantec says: Ok, but we would like your money I had run the sslLabs test earlier in the week and had to correct for Poodle by adding the following to /etc/httpd/conf.d/ssl.conf SSLProtocol All -SSLv2 -SSLv3 I had originally set the value in the virtual host config files, but sslLabs still pegged the grade as a “C”. Making the change in /etc/httpd/conf.d/ssl.conf and refreshing the results brought my grade up to a “B”. Still some work to be done In the same /etc/httpd/conf.d/ssl.conf file I also updated the ciphers — and...