Skip to content

Commit c737e92

Browse files
0xb4lint0xb4lint
committed
Mozilla SSL profiles (with TLSv1.3)
1 parent 69a3d77 commit c737e92

File tree

5 files changed

+132
-47
lines changed

5 files changed

+132
-47
lines changed

‎README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,8 @@ Contributions are what make the open source community such an amazing place to b
9797
* [notie](https://jaredreich.com/notie/) - toast notifications
9898

9999
## 📚 Resources
100+
* [Mozilla SSL Configuration Generator v5](https://ssl-config.mozilla.org)
101+
* [Mozilla SSL Configuration Generator](https://mozilla.github.io/server-side-tls/ssl-config-generator/)
100102
* [OWASP TLS Cipher String Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/TLS_Cipher_String_Cheat_Sheet.md)
101103
* [Nginx Optimization: understanding sendfile, tcp_nodelay and tcp_nopush](https://thoughts.t37.net/nginx-optimization-understanding-sendfile-tcp-nodelay-and-tcp-nopush-c55cdd276765)
102104
* [NGINX Tuning For Best Performance](https://gist.github.com/denji/8359866)

‎public/assets/js/app.js

Lines changed: 110 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@
6565
}],
6666

6767
// COMMON - HTTPS
68-
ssl_profile: 'B',
68+
ssl_profile: 'intermediate',
6969
resolver_cloudflare: true,
7070
resolver_google: true,
7171
resolver_opendns: true,
@@ -404,26 +404,117 @@
404404
'pptx?|potx?|pptm|potm|ppsx?',
405405
};
406406

407+
// https://github.com/mozilla/ssl-config-generator/blob/master/config/server-side-tls-conf-5.0.json
407408
$scope.sslProfiles = {
408-
A: {
409-
name: 'OWASP A (Advanced)',
410-
protocols: 'TLSv1.2 TLSv1.3',
411-
ciphers: 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256',
409+
modern: {
410+
name: 'Mozilla Modern',
411+
protocols: [
412+
'TLSv1.3',
413+
],
414+
ciphers: [
415+
'TLS_AES_256_GCM_SHA384',
416+
'TLS_AES_128_GCM_SHA256',
417+
'TLS_CHACHA20_POLY1305_SHA256',
418+
],
419+
server_preferred_order: false,
420+
dh_param_size: false,
421+
oldest_clients: ['Firefox 63', 'Android 10.0', 'Chrome 70', 'Edge 75', 'Java 11', 'OpenSSL 1.1.1', 'Opera 57', 'Safari 12.1'],
412422
},
413-
B: {
414-
name: 'OWASP B (Broad Compatibility)',
415-
protocols: 'TLSv1.2 TLSv1.3',
416-
ciphers: 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256',
423+
intermediate: {
424+
name: 'Mozilla Intermediate',
425+
protocols: [
426+
'TLSv1.2',
427+
'TLSv1.3',
428+
],
429+
ciphers: [
430+
'TLS_AES_256_GCM_SHA384',
431+
'TLS_AES_128_GCM_SHA256',
432+
'TLS_CHACHA20_POLY1305_SHA256',
433+
'ECDHE-ECDSA-AES256-GCM-SHA384',
434+
'ECDHE-RSA-AES256-GCM-SHA384',
435+
'ECDHE-ECDSA-AES128-GCM-SHA256',
436+
'ECDHE-RSA-AES128-GCM-SHA256',
437+
'ECDHE-ECDSA-CHACHA20-POLY1305',
438+
'ECDHE-RSA-CHACHA20-POLY1305',
439+
'DHE-RSA-AES256-GCM-SHA384',
440+
'DHE-RSA-AES128-GCM-SHA256',
441+
],
442+
server_preferred_order: true,
443+
dh_param_size: 2048,
444+
oldest_clients: ['Firefox 27', 'Android 4.4.2', 'Chrome 31', 'Edge', 'IE 11 on Windows 7', 'Java 8u31', 'OpenSSL 1.0.1', 'Safari 9'],
417445
},
418-
C: {
419-
name: 'OWASP C (Widest Compatibility)',
420-
protocols: 'TLSv1 TLSv1.1 TLSv1.2 TLSv1.3',
421-
ciphers: 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA',
422-
},
423-
D: {
424-
name: 'OWASP D (Legacy)',
425-
protocols: 'TLSv1 TLSv1.1 TLSv1.2 TLSv1.3',
426-
ciphers: 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA',
446+
old: {
447+
name: 'Mozilla Old',
448+
protocols: [
449+
'TLSv1',
450+
'TLSv1.1',
451+
'TLSv1.2',
452+
'TLSv1.3',
453+
],
454+
ciphers: [
455+
'TLS_AES_256_GCM_SHA384',
456+
'TLS_AES_128_GCM_SHA256',
457+
'TLS_CHACHA20_POLY1305_SHA256',
458+
'ECDHE-ECDSA-CHACHA20-POLY1305',
459+
'ECDHE-RSA-CHACHA20-POLY1305',
460+
'ECDHE-ECDSA-AES128-GCM-SHA256',
461+
'ECDHE-RSA-AES128-GCM-SHA256',
462+
'ECDHE-ECDSA-AES256-GCM-SHA384',
463+
'ECDHE-RSA-AES256-GCM-SHA384',
464+
'DHE-RSA-AES128-GCM-SHA256',
465+
'DHE-RSA-AES256-GCM-SHA384',
466+
'DHE-DSS-AES128-GCM-SHA256',
467+
'DHE-DSS-AES256-GCM-SHA384',
468+
'ECDHE-RSA-AES128-SHA256',
469+
'ECDHE-ECDSA-AES128-SHA256',
470+
'ECDHE-RSA-AES128-SHA',
471+
'ECDHE-ECDSA-AES128-SHA',
472+
'ECDHE-RSA-AES256-SHA384',
473+
'ECDHE-ECDSA-AES256-SHA384',
474+
'ECDHE-RSA-AES256-SHA',
475+
'ECDHE-ECDSA-AES256-SHA',
476+
'DHE-RSA-AES128-SHA256',
477+
'DHE-RSA-AES128-SHA',
478+
'DHE-DSS-AES128-SHA256',
479+
'DHE-RSA-AES256-SHA256',
480+
'DHE-DSS-AES256-SHA',
481+
'DHE-RSA-AES256-SHA',
482+
'ECDHE-RSA-DES-CBC3-SHA',
483+
'ECDHE-ECDSA-DES-CBC3-SHA',
484+
'EDH-RSA-DES-CBC3-SHA',
485+
'AES128-GCM-SHA256',
486+
'AES256-GCM-SHA384',
487+
'AES128-SHA256',
488+
'AES256-SHA256',
489+
'AES128-SHA',
490+
'AES256-SHA',
491+
'DHE-DSS-AES256-SHA256',
492+
'DHE-DSS-AES128-SHA',
493+
'DES-CBC3-SHA',
494+
'DHE-RSA-CHACHA20-POLY1305',
495+
'ECDHE-RSA-CAMELLIA256-SHA384',
496+
'ECDHE-ECDSA-CAMELLIA256-SHA384',
497+
'DHE-RSA-CAMELLIA256-SHA256',
498+
'DHE-DSS-CAMELLIA256-SHA256',
499+
'DHE-RSA-CAMELLIA256-SHA',
500+
'DHE-DSS-CAMELLIA256-SHA',
501+
'CAMELLIA256-SHA256',
502+
'CAMELLIA256-SHA',
503+
'ECDHE-RSA-CAMELLIA128-SHA256',
504+
'ECDHE-ECDSA-CAMELLIA128-SHA256',
505+
'DHE-RSA-CAMELLIA128-SHA256',
506+
'DHE-DSS-CAMELLIA128-SHA256',
507+
'DHE-RSA-CAMELLIA128-SHA',
508+
'DHE-DSS-CAMELLIA128-SHA',
509+
'CAMELLIA128-SHA256',
510+
'CAMELLIA128-SHA',
511+
'DHE-RSA-SEED-SHA',
512+
'DHE-DSS-SEED-SHA',
513+
'SEED-SHA',
514+
],
515+
server_preferred_order: true,
516+
dh_param_size: 1024,
517+
oldest_clients: ['Firefox 1', 'Chrome 1', 'Opera 5', 'Safari 1', 'IE8 on Windows XP', 'Android 2.3', 'Java 7', 'OpenSSL 0.9.8'],
427518
},
428519
};
429520

@@ -948,11 +1039,7 @@
9481039

9491040
// COMMON - HTTPS
9501041
$scope.isSSLDHRequired = function() {
951-
return $scope.hasHTTPS() && $scope.sslProfiles[$scope.data.ssl_profile].ciphers.indexOf(':DHE') !== -1;
952-
};
953-
954-
$scope.isSSLProfileLegacy = function() {
955-
return $scope.hasHTTPS() && $scope.data.ssl_profile === 'D';
1042+
return $scope.hasHTTPS() && $scope.sslProfiles[$scope.data.ssl_profile].dh_param_size;
9561043
};
9571044

9581045
$scope.isResolverCloudflare = function() {

‎public/index.html

Lines changed: 13 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -605,28 +605,22 @@
605605
<div class="row">
606606
<legend class="col-sm-3 col-form-label col-form-label-sm">SSL profile</legend>
607607
<div class="col-sm-9">
608-
<div class="form-check form-check-inline" ng-class="{ 'input-changed': data.ssl_profile !== defaultData.ssl_profile && data.ssl_profile === 'A' }">
609-
<input class="form-check-input" type="radio" id="OWASP-A" ng-model="data.ssl_profile" value="A">
610-
<label class="form-check-label col-form-label-sm" for="OWASP-A">
611-
<span tooltips tooltip-template="<strong>Advanced</strong>, wide browser compatibility, e.g. to most newer browser versions<br><br>Oldest compatible clients:<ul><li>Android 4.4.2</li><li>Chrome 32/Win 7</li><li>Chrome 34/OS X</li><li>Edge 12/Win 10</li><li>Firefox 27/Win 8</li><li>IE11/Win 7 + MS14-066</li><li>Java8b132</li><li>OpenSSL 1.0.1e</li><li>Safari 9/iOS 9.</li></ul>" tooltip-side="top" tooltip-class="ssl">OWASP A</span>
608+
<div class="form-check form-check-inline" ng-class="{ 'input-changed': data.ssl_profile !== defaultData.ssl_profile && data.ssl_profile === 'modern' }">
609+
<input class="form-check-input" type="radio" id="ssl-modern" ng-model="data.ssl_profile" value="modern">
610+
<label class="form-check-label col-form-label-sm" for="ssl-modern">
611+
<span tooltips tooltip-template="For services that don't need backward compatibility, the parameters below provide a higher level of security.<br><br>Oldest compatible clients:<ul><li>{{ sslProfiles.modern.oldest_clients.join('</li><li>') }}</li></ul>" tooltip-side="top" tooltip-class="ssl">Mozilla Modern</span>
612612
</label>
613613
</div>
614-
<div class="form-check form-check-inline" ng-class="{ 'input-changed': data.ssl_profile !== defaultData.ssl_profile && data.ssl_profile === 'B' }">
615-
<input class="form-check-input" type="radio" id="OWASP-B" ng-model="data.ssl_profile" value="B">
616-
<label class="form-check-label col-form-label-sm" for="OWASP-B">
617-
<span tooltips tooltip-template="<strong>Broad</strong> compatibility to browsers, check the compatibility to other protocols before using it, e.g. IMAPS<br><br>Oldest compatible clients: <ul><li>Android 4.4.2</li><li>Chrome 30/Win 7</li><li>Chrome 34/OS X</li><li>Edge 12/Win 10</li><li>Firefox 27/Win 8</li><li>IE11/Win 7</li><li>IE 11/WinPhone 8.1</li><li>Java8b132</li><li>OpenSSL 1.0.1e</li><li>Opera 17/Win 7</li><li>Safari 5/iOS 5.1.1</li><li>Safari 7/OS X 10.9</li></ul>" tooltip-side="top" tooltip-class="ssl">OWASP B</span>
614+
<div class="form-check form-check-inline" ng-class="{ 'input-changed': data.ssl_profile !== defaultData.ssl_profile && data.ssl_profile === 'intermediate' }">
615+
<input class="form-check-input" type="radio" id="ssl-intermediate" ng-model="data.ssl_profile" value="intermediate">
616+
<label class="form-check-label col-form-label-sm" for="ssl-intermediate">
617+
<span tooltips tooltip-template="For services that don't need compatibility with legacy clients, but still need to support a wide range of clients, this configuration is recommended.<br><br>Oldest compatible clients: <ul><li>{{ sslProfiles.intermediate.oldest_clients.join('</li><li>') }}</li></ul>" tooltip-side="top" tooltip-class="ssl">Mozilla Intermediate</span>
618618
</label>
619619
</div>
620-
<div class="form-check form-check-inline" ng-class="{ 'input-changed': data.ssl_profile !== defaultData.ssl_profile && data.ssl_profile === 'C' }">
621-
<input class="form-check-input" type="radio" id="OWASP-C" ng-model="data.ssl_profile" value="C">
622-
<label class="form-check-label col-form-label-sm" for="OWASP-C">
623-
<span tooltips tooltip-template="<strong>Widest Compatibility</strong>, compatibility to most legacy browsers, legacy libraries (still patched) and other application protocols besides https, e.g. IMAPS<br><br>Oldest compatible clients: <ul><li>Android 2.3.7/4.0.4</li><li>Chrome 27/Win 7</li><li>Chrome 34/OS X</li><li>Edge 12/Win 10</li><li>Firefox 10.0.12 ESR/Win 7</li><li>Firefox 21/Win 7+Fedora 19</li><li>IE 7/Vista</li><li>IE 10/WinPhone 8.0</li><li>Java 7u25</li><li>OpenSSL 0.9.8y</li><li>Opera 12.15/Win 7</li><li>Safari 5/iOS 5.1.1</li><li>Safari 5.1.9/OS X 10.6.8</li></ul>" tooltip-side="top" tooltip-class="ssl">OWASP C</span>
624-
</label>
625-
</div>
626-
<div class="form-check form-check-inline" ng-class="{ 'input-changed': data.ssl_profile !== defaultData.ssl_profile && data.ssl_profile === 'D' }">
627-
<input class="form-check-input" type="radio" id="OWASP-D" ng-model="data.ssl_profile" value="D">
628-
<label class="form-check-label col-form-label-sm" for="OWASP-D">
629-
<span tooltips tooltip-template="<strong>Legacy</strong>, widest compatibility to real old browsers and legacy libraries and other application protocols like SMTP" tooltip-side="top" tooltip-class="ssl">OWASP D</span>
620+
<div class="form-check form-check-inline" ng-class="{ 'input-changed': data.ssl_profile !== defaultData.ssl_profile && data.ssl_profile === 'old' }">
621+
<input class="form-check-input" type="radio" id="ssl-old" ng-model="data.ssl_profile" value="old">
622+
<label class="form-check-label col-form-label-sm" for="ssl-old">
623+
<span tooltips tooltip-template="This is the old ciphersuite that works with all clients back to Windows XP/IE6. It should be used as a last resort only.<br><br>Oldest compatible clients: <ul><li>{{ sslProfiles.old.oldest_clients.join('</li><li>') }}</li></ul>" tooltip-side="top" tooltip-class="ssl">Mozilla Old</span>
630624
</label>
631625
</div>
632626
</div>
@@ -655,7 +649,7 @@
655649
<label class="col-sm-3 col-form-label col-form-label-sm">
656650
Let's Encrypt webroot
657651
</label>
658-
<div class="col-sm-9">
652+
<div class="col-sm-9 col-xl-7">
659653
<input type="text"
660654
class="form-control form-control-sm"
661655
ng-model="data.directory_letsencrypt"

‎public/templates/commands.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@
2323
--><!--
2424
2525
✔ SSL DH required --><span ng-if="isSSLDHRequired()"><span class="hljs-comment"><span class="counter">.</span> Generate Diffie-Hellman keys:</span>
26-
<span class="hljs-section">openssl</span> <span class="hljs-attribute">dhparam -dsaparam</span> <span class="hljs-attribute">-out</span> {{ data.directory_nginx }}dhparam.pem <span class="hljs-number">{{ isSSLProfileLegacy() ? 1024 : 2048 }}</span>
26+
<span class="hljs-section">openssl</span> <span class="hljs-attribute">dhparam -dsaparam</span> <span class="hljs-attribute">-out</span> {{ data.directory_nginx }}dhparam.pem <span class="hljs-number">{{ sslProfiles[ data.ssl_profile ].dh_param_size }}</span>
2727
</span><!--
2828
2929
✔ Let's Encrypt

‎public/templates/conf/nginx.conf.html

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@
5252

5353
# SSL
5454
ssl_session_timeout 1d;
55-
ssl_session_cache shared:SSL:50m;
55+
ssl_session_cache shared:SSL:10m;
5656
ssl_session_tickets off;<!--
5757
5858
✔ SSL DH required --><span ng-if="isSSLDHRequired()">
@@ -61,9 +61,11 @@
6161
ssl_dhparam {{ data.directory_nginx }}dhparam.pem;</span>
6262

6363
# {{ sslProfiles[ data.ssl_profile ].name }} configuration
64-
ssl_protocols {{ sslProfiles[ data.ssl_profile ].protocols }};
65-
ssl_ciphers {{ sslProfiles[ data.ssl_profile ].ciphers }};
66-
ssl_prefer_server_ciphers on;
64+
ssl_protocols {{ sslProfiles[ data.ssl_profile ].protocols.join(' ') }};
65+
ssl_ciphers {{ sslProfiles[ data.ssl_profile ].ciphers.join(':') }};<!--
66+
67+
✔ SSL server preferred order --><span ng-if="sslProfiles[ data.ssl_profile ].server_preferred_order">
68+
ssl_prefer_server_ciphers on;</span>
6769

6870
# OCSP Stapling
6971
ssl_stapling on;

0 commit comments

Comments
 (0)