We have a privately hosted production system and an AWS machine we use for testing. Both systems have the same structure:
- SSL termination with haproxy,
- passing to an Apache server hosting a rails website,
- plus a load of auxiliary services etc.
My attempts at hardening our system in haproxy:
ssl-default-bind-options no-sslv3 ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS ssl-default-server-options no-sslv3 ssl-default-server-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS tune.ssl.default-dh-param 2048
On AWS our system got an
A on the Qualys SSL labs test (ignoring trust issues as we didn't pay for a verified certificate on our private test system).
On our production, the system got a solid
F, citing the (CVE-2016-2107) vulnerability. Apparently the fix is to upgrade openssl version (presently 1.0.1e on both systems... !)
I'm curious, though, as to why this was an issue on our privately hosted server but not on AWS? I'm asking because we always try things out on AWS before our production machine to see if e.g. a software upgrade breaks anything, so I'd like to be aware of some intrinsic difference in that environment so that I don't get caught out on the live version...
Many thanks in advance.