SSL Configuration Generator
Why are we still using the term "SSL" anywhere? It feels immediately like someone forgot the last 10 years of tech.
Proper configuration of cryptography should not be abdicated to application developers or operators: https://go.dev/blog/tls-cipher-suites
> The Mozilla SSL Configuration Generator is great, and it should not exist.
It's sad-funny that they include OCSP stapling when ~browsers~^W Let's Encrypt have decided to eradicate OCSP (including stapled OCSP) :(.
They also have configs for ssh, although without the cool generator.
Why are they recommending SSLHonorCipherOrder Off ?
I don’t see any option in this config generator for mTLS (mutual TLS, where you use client certificates in addition to server certificates).
Perhaps it is too niche of a thing. Sadly. It really is quite useful in some situations.
Their "AWS ELB" seems to be a Classic Load Balancer; probably not the best term to use. The "AWS ALB" is an Application Load Balancer, of course.
A similar too for OpenSSL config would be great
This has been around for a long time. Kudos to the folks that built it. It served a need at the time and made a big impact on improving configurations for people that didn't understand the myriad of ways to setup ssl/tls.
This looks like something that's been around forever, but it's the first time I've seen it. xkcd://{{derive_from_context}}
It's a great idea. I've created (or copied) at least half of these output formats, a few of which I remember being annoyingly difficult to surface from the project docs.
But in the moment today, it's mostly interesting to see the different ways of saying the same things in various configuration languages. And thinking that this might be why so many people with different brains find the technology world so obtuse and off-putting.
The joke's on them, of course. We like it this way! (Never wrestle with a pig...)
it is amazing that Chrome 80 still hasn’t upgrade its OpenSSL to v1.1.1.
How do these configs differ to server defaults? If some really bad settings are enabled by default (thus needing this custom config), shouldn't it be better just to have the server-software devs fix the defaults to be 'good enough' (for most)?
why the site's back button doesn't work?
[dead]
Thanks Mozilla, I don't know what I would do if I couldn't generate a config for Apache 420 with OpenSSL 69.
In a similar spirit there is also a site to scan security headers of any site [1] and another to verify the TLS settings from the Mozilla SSL Configuration Generator [2] and a git repo with code to scan sites from the command line [3] useful if the site is not reachable on the internet or automated scans to HTML reports.
[1] - https://securityheaders.com/
[2] - https://www.ssllabs.com/ssltest/
[3] - https://github.com/testssl/testssl.sh