Rootmanual:SSL: Skillnad mellan sidversioner

Från Lysators datorhandbok, den ultimata referensen.
Hoppa till navigering Hoppa till sök
Ingen redigeringssammanfattning
Rad 8: Rad 8:
! host !! CN !! port !! Certificate !! Protocol support !! Key exchange !! Cipher strength !! Valid from !! Valid until !! Key !! Signature algorithm !! TLS1.2 !! TLS1.1 !! TLS1.0 !! SSL3 !! SSL2 !! PFS !! HSTS !! OCSP !! NPN !! SPDY !! analyze.py (mozilla-nivå) !! annat
! host !! CN !! port !! Certificate !! Protocol support !! Key exchange !! Cipher strength !! Valid from !! Valid until !! Key !! Signature algorithm !! TLS1.2 !! TLS1.1 !! TLS1.0 !! SSL3 !! SSL2 !! PFS !! HSTS !! OCSP !! NPN !! SPDY !! analyze.py (mozilla-nivå) !! annat
|-
|-
|admin ||admin ||443 || 100 || 95 || 80 || 90 || 2012-07-26 || 2015-09-01 || RSA2048 ||SHA1wRSA || Y || Y || Y || N || N || P || N || N || N || N || ||
|admin ||admin ||443 || 100 || 95 || 80 || 90 || 2012-07-26 || 2015-09-01 || RSA2048 ||SHA1wRSA || Y || Y || Y || N || N || P || N || N || N || N || "bad" ||
|-
|-
|bugzilla||bugzilla||443||100 || 90 || 80 || 90 || 2014-07-17 || 2017-07-16 || RSA2048 || SHA1wRSA || Y || Y || Y || Y || N || P || Y || N || N || N || "bad" || Kortvarig HSTS
|bugzilla||bugzilla||443||100 || 90 || 80 || 90 || 2014-07-17 || 2017-07-16 || RSA2048 || SHA1wRSA || Y || Y || Y || Y || N || P || Y || N || N || N || "bad" || Kortvarig HSTS
Rad 20: Rad 20:
|git || git || 443 || 100 || 95 || 80 || 90 || 2014-04-10 || 2017-04-09 || RSA2048 || SHA1wRSA || Y || Y || Y || N || N || Y || Y || N || Y || N || "bad" ||
|git || git || 443 || 100 || 95 || 80 || 90 || 2014-04-10 || 2017-04-09 || RSA2048 || SHA1wRSA || Y || Y || Y || N || N || Y || Y || N || Y || N || "bad" ||
|-
|-
|httpkom ||httpkom ||443 || 100 || 95 || 80 || 90 || 2012-07-26 || 2015-07-27 || RSA2048 || SHA1wRSA || Y || Y || Y || N || N || Y || N || N || N || N || ||
|httpkom ||httpkom ||443 || 100 || 95 || 80 || 90 || 2012-07-26 || 2015-07-27 || RSA2048 || SHA1wRSA || Y || Y || Y || N || N || Y || N || N || N || N || "bad" ||
|-
|-
|imap ||imap || || || || || || || || || || || || || || || || || || || || ||
|imap ||imap || || || || || || || || || || || || || || || || || || || || ||
Rad 26: Rad 26:
|jabber || lysator.liu.se ||5222|| || || || || 2014-04-23 || 2017-04-22 || RSA2048 || SHA1wRSA || || || || || || || || || || || || Observera CN vid förnyande
|jabber || lysator.liu.se ||5222|| || || || || 2014-04-23 || 2017-04-22 || RSA2048 || SHA1wRSA || || || || || || || || || || || || Observera CN vid förnyande
|-
|-
|jskom ||jskom ||443 || 100 || 95 || 80 || 90 || 2012-07-26 || 2015-07-27 || RSA2048 || SHA1wRSA || Y || Y || Y || N || N || Y || N || N || N || N || ||
|jskom ||jskom ||443 || 100 || 95 || 80 || 90 || 2012-07-26 || 2015-07-27 || RSA2048 || SHA1wRSA || Y || Y || Y || N || N || Y || N || N || N || N || "bad" ||
|-
|-
|lists ||lists ||443 || 100 || 70 || 90 || 80 || 2012-07-26 || 2015-09-01 || RSA2048 || SHA1wRSA || N || N || Y || N || N || N || N || N || N || N || ||
|lists ||lists ||443 || 100 || 70 || 90 || 80 || 2012-07-26 || 2015-09-01 || RSA2048 || SHA1wRSA || N || N || Y || N || N || N || N || N || N || N || "bad" ||
|-
|-
|login || login || 443 || 100 || 95 || 80 || 90 || 2014-07-04 || 2017-07-03 || RSA2048 || SHA1wRSA || Y || Y || Y || N || N || Y || Y || Y || Y || Y || "bad" ||
|login || login || 443 || 100 || 95 || 80 || 90 || 2014-07-04 || 2017-07-03 || RSA2048 || SHA1wRSA || Y || Y || Y || N || N || Y || Y || Y || Y || Y || "bad" ||
Rad 50: Rad 50:
|thinlinc ||thinlinc || || || || || || || || || || || || || || || || || || || || ||
|thinlinc ||thinlinc || || || || || || || || || || || || || || || || || || || || ||
|-
|-
|webkom ||webkom ||443 || 100 || 95 || 80 || 90 || 2012-07-26 || 2015-09-01 || RSA2048 || SHA1wRSA || Y || Y || Y || N || N || Y || N || N || N || N || ||
|webkom ||webkom ||443 || 100 || 95 || 80 || 90 || 2012-07-26 || 2015-09-01 || RSA2048 || SHA1wRSA || Y || Y || Y || N || N || Y || N || N || N || N || "bad" ||
|-
|-
|webmail ||webmail ||443 || 100 || 70 || 90 || 80 || 2012-07-26 || 2015-09-01 || RSA2048 || SHA1wRSA || N || N || Y || N || N || N || N || N || N || N || ||
|webmail ||webmail ||443 || 100 || 70 || 90 || 80 || 2012-07-26 || 2015-09-01 || RSA2048 || SHA1wRSA || N || N || Y || N || N || N || N || N || N || N || "bad" ||
|-
|-
|webware ||webware ||443 || || || || || || || || || || || || || || || || || || || ||
|webware ||webware ||443 || || || || || || || || || || || || || || || || || || || ||

Versionen från 17 oktober 2014 kl. 21.09

https://www.ssllabs.com/ssltest/analyze.html är användbar för snabb överblick över vad som kan förbättras för ett cert, även https://github.com/jvehent/cipherscan med bl.a. analyze.py kan vara behjälplig.

https://wiki.mozilla.org/Security/Server_Side_TLS går igenom mycket som är bra att veta om hur man ställer in sin httpd, t.ex. cipher suites osv.

Inventering av certifikat

host CN port Certificate Protocol support Key exchange Cipher strength Valid from Valid until Key Signature algorithm TLS1.2 TLS1.1 TLS1.0 SSL3 SSL2 PFS HSTS OCSP NPN SPDY analyze.py (mozilla-nivå) annat
admin admin 443 100 95 80 90 2012-07-26 2015-09-01 RSA2048 SHA1wRSA Y Y Y N N P N N N N "bad"
bugzilla bugzilla 443 100 90 80 90 2014-07-17 2017-07-16 RSA2048 SHA1wRSA Y Y Y Y N P Y N N N "bad" Kortvarig HSTS
datorhandbok datorhandbok 443 100 95 80 90 2014-04-23 2017-04-22 RSA2048 SHA1wRSA Y Y Y N N Y N N N N "intermediate" när OCSP och SHA256
enodia
ftp
git git 443 100 95 80 90 2014-04-10 2017-04-09 RSA2048 SHA1wRSA Y Y Y N N Y Y N Y N "bad"
httpkom httpkom 443 100 95 80 90 2012-07-26 2015-07-27 RSA2048 SHA1wRSA Y Y Y N N Y N N N N "bad"
imap imap
jabber lysator.liu.se 5222 2014-04-23 2017-04-22 RSA2048 SHA1wRSA Observera CN vid förnyande
jskom jskom 443 100 95 80 90 2012-07-26 2015-07-27 RSA2048 SHA1wRSA Y Y Y N N Y N N N N "bad"
lists lists 443 100 70 90 80 2012-07-26 2015-09-01 RSA2048 SHA1wRSA N N Y N N N N N N N "bad"
login login 443 100 95 80 90 2014-07-04 2017-07-03 RSA2048 SHA1wRSA Y Y Y N N Y Y Y Y Y "bad"
mail mail
medreg medreg 443 100 95 80 90 2014-04-10 2017-04-09 RSA2048 SHA1wRSA Y Y Y N N P N N N N "bad" RC4 vid TLS1.1+ är dåligt.
mrtg
nagios nagios 443 100 95 90 90 2014-04-23 2017-04-22 RSA2048 SHA1wRSA Y Y Y N N Y N N Y N "bad" Uppgradera OpenSSL omedelbart
nagiosql
pop pop
proxar
proxer
thinlinc thinlinc
webkom webkom 443 100 95 80 90 2012-07-26 2015-09-01 RSA2048 SHA1wRSA Y Y Y N N Y N N N N "bad"
webmail webmail 443 100 70 90 80 2012-07-26 2015-09-01 RSA2048 SHA1wRSA N N Y N N N N N N N "bad"
webware webware 443
www www 443 100 95 80 90 2014-04-23 2017-04-22 RSA2048 SHA1wRSA Y Y Y N N Y N N N N "intermediate" när OCSP och SHA256

P = Partial

Situationen generellt nu är att SHA1 bör ersättas med SHA256 innan 2016, vilket gör att det vore bra ifall alla certifikat vi har låtit få utgivna sammanställdes t.ex. här, så att man enkelt kan söka dem i klump när det väl drar ihop sig.

Hämtad från ”https://datorhandbok.lysator.liu.se/index.php?title=Rootmanual:SSL&oldid=4799”