Go and the Qualsys SSL Labs test

[Nick Craig-Wood]

I've been trying to configure a go ssl server and I was wondering how
secure it was so I ran a default Go (1.2) configured SSL server through

https://www.ssllabs.com/ssltest/

I was very pleased with the result of "A-" :-)

The two points of interest were

* There is no support for secure renegotiation. Grade reduced to A-

* The server does not support Forward Secrecy with the reference
browsers. Grade reduced to A-

I think the forward secrecy issue can be fixed with cipher choice, but I
don't know about the secure renegotiation.

Does anyone have any ideas? (Other than use apache/nginx/etc as a proxy)

Thanks

Nick
--
Nick Craig-Wood <ni...@craig-wood.com> -- http://www.craig-wood.com/nick

[mkob...@gmail.com]

"Nick Craig-Wood"<ni...@craig-wood.com> wrote:
> I think the forward secrecy issue can be fixed with cipher choice, but I
> don't know about the secure renegotiation.
>
> Does anyone have any ideas? (Other than use apache/nginx/etc as a proxy)

It most likely looks for support for renegotiation_info extension, http://tools.ietf.org/search/rfc5746. If the TLS package doesn't support it, the next best thing is to disable renegotiation (which it most likely would be by default in that case).

HTH,

Martin

[agl]

On Monday, February 17, 2014 10:08:13 AM UTC-5, Nick Craig-Wood wrote:

  * There is no support for secure renegotiation. Grade reduced to A-

Fixed in trunk so will be in 1.3.

I think the forward secrecy issue can be fixed with cipher choice, but I
don't know about the secure renegotiation.

I think one needs multiplicative DH support in order to make SSL Labs happy about the old browsers and crypto/tls doesn't implement that. It wouldn't be too hard to do if someone is keen.

Cheers

AGL

[Nick Craig-Wood]

On 18/02/14 18:01, agl wrote:
> On Monday, February 17, 2014 10:08:13 AM UTC-5, Nick Craig-Wood wrote:
>
> * There is no support for secure renegotiation. Grade reduced to A-
>
>
> Fixed in trunk so will be in 1.3.

Excellent - thank you :-)

> I think the forward secrecy issue can be fixed with cipher choice,
> but I
> don't know about the secure renegotiation.
>
> I think one needs multiplicative DH support in order to make SSL Labs
> happy about the old browsers and crypto/tls doesn't implement that. It
> wouldn't be too hard to do if someone is keen.

Luckily it is an issue which will go away in time along with the older
browsers!