whonix.org server SSL settings enhancement

[phabricator-migrator]

Information

ID: 917
PHID: PHID-TASK-kmwzdkkklbudumelczjm
Author: Patrick
Status at Migration Time: resolved
Priority at Migration Time: Normal

Description

DNS Certification Authority Authorization (CAA) Policy / DNSSEC for whonix.org / ssllabs.com test results / OCSP ERROR: Exception: connect timed out [http://r3.o.lencr.org] / Must-Staple

TLS 1.1 and CBC cipher considered weak now better to be deprecated for security reasons: https://www.ssllabs.com/ssltest/analyze.html?d=deb.whonix.org&s=95.216.25.250&latest Also now TLS 1.3 available with Lets Encrypt, is it good idea to support it ? cc @Patrick → T917 whonix.org server SSL settings enhancement

@TNTBOMBOM

TLS 1.1 and CBC cipher considered weak now better to be deprecated for security reasons:

https://www.ssllabs.com/ssltest/analyze.html?d=deb.whonix.org&s=95.216.25.250&latest

Also now TLS 1.3 available with Lets Encrypt, is it good idea to support it ?

An Overview of TLS 1.3 - Faster and More Secure

Comments

---

Patrick

2021-12-09 14:45:30 UTC

This was done a long time ago.