Tuned HTTPS cipher suites to get A+ on SSL labs testing."
Ylian Saint-Hilaire committed
Nov 2, 2022 at 22:36 UTC
99fc690f4b76f3a00070e7885537f8353f9ab99f
1 file changed
+28
-1
webserver.js
+28
-1
@@ -5999,9 +5999,36 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
5999
// Setup the HTTP server without TLS
6000
obj.expressWs = require('express-ws')(obj.app, null, { wsOptions: { perMessageDeflate: (args.wscompression === true) } });
6001
} else {
6002
+ var ciphers = [
6003
+ 'TLS_AES_256_GCM_SHA384',
6004
+ 'TLS_AES_128_GCM_SHA256',
6005
+ 'TLS_AES_128_CCM_8_SHA256',
6006
+ 'TLS_AES_128_CCM_SHA256',
6007
+ 'TLS_CHACHA20_POLY1305_SHA256',
6008
+ 'ECDHE-RSA-AES256-GCM-SHA384',
6009
+ 'ECDHE-ECDSA-AES256-GCM-SHA384',
6010
+ 'ECDHE-RSA-AES128-GCM-SHA256',
6011
+ 'ECDHE-ECDSA-AES128-GCM-SHA256',
6012
+ 'DHE-RSA-AES128-GCM-SHA256',
6013
+ 'ECDHE-RSA-CHACHA20-POLY1305', // TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8)
6014
+ 'ECDHE-ARIA128-GCM-SHA256',
6015
+ 'ECDHE-ARIA256-GCM-SHA384',
6016
+ 'ECDHE-RSA-AES128-SHA256', // SSLlabs considers this cipher suite weak, but it's needed for older browers.
6017
+ 'ECDHE-RSA-AES256-SHA384', // SSLlabs considers this cipher suite weak, but it's needed for older browers.
6018
+ '!aNULL',
6019
+ '!eNULL',
6020
+ '!EXPORT',
6021
+ '!DES',
6022
+ '!RC4',
6023
+ '!MD5',
6024
+ '!PSK',
6025
+ '!SRP',
6026
+ '!CAMELLIA'
6027
+ ].join(':');
6028
+
6029
// Setup the HTTP server with TLS, use only TLS 1.2 and higher with perfect forward secrecy (PFS).
6030
//const tlsOptions = { cert: obj.certificates.web.cert, key: obj.certificates.web.key, ca: obj.certificates.web.ca, rejectUnauthorized: true, ciphers: "HIGH:!aNULL:!eNULL:!EXPORT:!RSA:!DES:!RC4:!MD5:!PSK:!SRP:!CAMELLIA", secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE | constants.SSL_OP_NO_TLSv1 | constants.SSL_OP_NO_TLSv1_1 }; // This does not work with TLS 1.3
6004
- const tlsOptions = { cert: obj.certificates.web.cert, key: obj.certificates.web.key, ca: obj.certificates.web.ca, rejectUnauthorized: true, ciphers: "HIGH:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_8_SHA256:TLS_AES_128_CCM_SHA256:TLS_CHACHA20_POLY1305_SHA256", secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE | constants.SSL_OP_NO_TLSv1 | constants.SSL_OP_NO_TLSv1_1 };
6031
+ const tlsOptions = { cert: obj.certificates.web.cert, key: obj.certificates.web.key, ca: obj.certificates.web.ca, rejectUnauthorized: true, ciphers: ciphers, secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION | constants.SSL_OP_CIPHER_SERVER_PREFERENCE | constants.SSL_OP_NO_TLSv1 | constants.SSL_OP_NO_TLSv1_1 };
6032
if (obj.tlsSniCredentials != null) { tlsOptions.SNICallback = TlsSniCallback; } // We have multiple web server certificate used depending on the domain name
6033
obj.tlsServer = require('https').createServer(tlsOptions, obj.app);
6034
obj.tlsServer.on('secureConnection', function () { /*console.log('tlsServer secureConnection');*/ });