{"id":20280,"date":"2015-08-15T16:44:00","date_gmt":"2015-08-15T09:44:00","guid":{"rendered":"https:\/\/kitty.in.th\/?p=20280"},"modified":"2016-12-05T16:31:18","modified_gmt":"2016-12-05T09:31:18","slug":"getting-a-from-qualys-ssl","status":"publish","type":"post","link":"https:\/\/kitty.in.th\/index.php\/2015\/08\/15\/getting-a-from-qualys-ssl\/","title":{"rendered":"Getting “A” from Qualy’s SSL"},"content":{"rendered":"

Qualys SSL Labs provides a SSL Server Test for awhile. You can rate your web site at https:\/\/www.ssllabs.com\/ssltest<\/p>\n

To get rating “A”, there are few straightforward tricks:<\/p>\n

    \n
  1. Disable all versions of SSL protocol. Enable only TLS. e.g.,\n
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2<\/pre>\n<\/li>\n
  2. Choose only strong ciphers, e.g., you’ll sacrifice some very old clients.\n
    ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS;<\/pre>\n<\/li>\n
  3. Use HSTS, e.g.,\n
    add_header Strict-Transport-Security max-age=31536000;<\/pre>\n<\/li>\n<\/ol>\n
    Optionally,<\/p>\n
    \r\nssl_dhparam \/etc\/ssl\/private\/dhparam.pem;\r\nssl_stapling on;\r\nssl_stapling_verify on;\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"
    Qualys SSL Labs provides a SSL Server Test for awhile. You can rate your web site at https:\/\/www.ssllabs.com\/ssltest To get rating “A”, there are few straightforward tricks: Disable all versions of SSL protocol. Enable only TLS. e.g., ssl_protocols TLSv1 TLSv1.1 TLSv1.2 Choose only strong ciphers, e.g., you’ll sacrifice some very old clients. ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS; Use … Continue reading Getting “A” from Qualy’s SSL<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[85,86],"tags":[126,5,100],"class_list":["post-20280","post","type-post","status-publish","format-standard","hentry","category-blog","category-lab","tag-admin","tag-linux","tag-security"],"_links":{"self":[{"href":"https:\/\/kitty.in.th\/index.php\/wp-json\/wp\/v2\/posts\/20280","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kitty.in.th\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kitty.in.th\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kitty.in.th\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kitty.in.th\/index.php\/wp-json\/wp\/v2\/comments?post=20280"}],"version-history":[{"count":4,"href":"https:\/\/kitty.in.th\/index.php\/wp-json\/wp\/v2\/posts\/20280\/revisions"}],"predecessor-version":[{"id":20285,"href":"https:\/\/kitty.in.th\/index.php\/wp-json\/wp\/v2\/posts\/20280\/revisions\/20285"}],"wp:attachment":[{"href":"https:\/\/kitty.in.th\/index.php\/wp-json\/wp\/v2\/media?parent=20280"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kitty.in.th\/index.php\/wp-json\/wp\/v2\/categories?post=20280"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kitty.in.th\/index.php\/wp-json\/wp\/v2\/tags?post=20280"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}