freebsd security - May 2015 - Forums.FreeBSD.org - SSL Issue?

On 14 mai 2015, at 12:02, Ian Smith wrote:
> Well, I can't reach https://forums.freebsd.org/ at all at the moment,
my
> (admittedly ancient, on 8.2) SeaMonkey now consistenly reports:
> 
> "Data Transfer Interrupted
> The connection to forums.freebsd.org has terminated unexpectedly. Some 
> data may have been transferred."
looks like your browser/OS does not support TLS 1.2.

> I checked 'forums.freebsd.org' at 
> https://www.ssllabs.com/ssltest/analyze.html?d=forums.freebsd.org which 
> is currently showing: "The server supports only older protocols, but
not
> the current best TLS 1.2. Grade capped to B."

I've printed the report as PDF:

http://patpro.net/~patpro/SSL-Server-Test-forums.freebsd.org.pdf

You can see what I see : grade A+, TLS 1.2 only, hence poor support for old
browser (more like old openssl)

regards,
patpro

Patrick Proniewski wrote:
>> "Data Transfer Interrupted
>> The connection to forums.freebsd.org has terminated unexpectedly. Some 
>> data may have been transferred."
> 
> looks like your browser/OS does not support TLS 1.2.
I'm confused by FreeBSD policy, a lot.

Base OpenSSL in still supported releases is too old version and doesn't
support TLS 1.2 as well.

Either TLS 1.0 is so insecure and should not be used, or is secure
enough for FreeBSD.

In the first case the base OpenSSL should be updated to something more
recent (so dangerous TLS 1.0 only should be considered security issue).

In the second case I see no reason to disable TLS 1.0 on
https://forums.freebsd.org - regardless the Qualsys rating.

I don't care which solution will be selected.

Just my $0.02

Dan