1

My openssl ciphers -v 'CIPHER' output is the following:

ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(256) Mac=AEAD
ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(256) Mac=AEAD
ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AES(256)  Mac=SHA384
ECDHE-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AES(256)  Mac=SHA384
DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(256) Mac=AEAD
DHE-RSA-AES256-SHA256   TLSv1.2 Kx=DH       Au=RSA  Enc=AES(256)  Mac=SHA256

I think that my server meet all theirs Key Exchange requirements to get a 100 SSL Server Rating Guide

3

My guess is that the DH parameters used for your DHE cipher suites use a 1024-bit modulus.

(I must say that this "scoring" is completely arbitrary and not very rational; awarding 128-bit symmetric keys a grade lower than the one for 256-bit symmetric keys makes sense only if 128-bit keys can be considered somehow "breakable" in the foreseeable future, which is a rather preposterous assertion.)

  • Thanks Tom. Could you pls point me out to how change such parameter? so I can execute again the test and get 100. I'm using Apache 2.2 and openssl 1.0.1 on Ubuntu 12.04. I share you criteria about key length, but result that lot of manager are taking that test result as a evaluation criteria of server setup security, so... my server must past it ;) – gsi-frank Oct 4 '13 at 1:33
  • 1
    @gsc-frank not even gmail/google get 100 across the board... ssllabs.com/ssltest/… – NULLZ Oct 4 '13 at 2:25
  • Yes, but they must balance the performance impact and client access vs security, in my case security is paramount ;) BTW, gmail got a 90 in key exchange ;) – gsi-frank Oct 4 '13 at 3:54
  • 2
    @gsc-frank: apparently, since version 2.5.0-dev of mod_ssl (from 5 days ago !), you can put custom DH parameters in the same file as the certificate; see the documentation. Note that there may be interoperability issues... and you won't get this with the stock Apache 2.2 from Ubuntu. Though I guess you could get the package source, patch it to use a bigger modulus, and recompile it. A simpler method would be to use only ECDHE cipher suites, but this may reject too many existing Web browsers for your taste. – Tom Leek Oct 4 '13 at 10:11
  • @TomLeek Thanks a lot! I will move to Apache 2.4 and then use only ECDHE ciphers to get a 4 x 100 score. Seem to me that still remain some time to such new mod_ssl option arrive to Ubuntu. Your help was very important, thanks again. – gsi-frank Oct 4 '13 at 15:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.