freebsd security - May 2015 - Forums.FreeBSD.org - SSL Issue?

On Thu, 14 May 2015 10:28:27 +0200, Patrick Proniewski wrote:
 > On 13 mai 2015, at 23:18, Anders Gulden Olstad wrote:
 > 
 > > Qualys report chain issues
 > 
 > that's pretty odd, because I've checked too just after sending my 
 > reply to the list (message id 
 > A2D58CCB-8B0A-40FF-9ED1-89B698A830DD at patpro.net), and Qualys reported 
 > no issues at all about the chain. That was about 7-8 hours before 
 > your message.
 > 
 > But well, the global note was B at this time, and now it's A+. They 
 > obviously upgraded TLS from 1.0 to 1.2, ditched support for
"old"
 > browsers, and made other cipher tuning. Good job admins (though I 
 > would have been a bit more conservative about browser support).

Well, I can't reach https://forums.freebsd.org/ at all at the moment, my 
(admittedly ancient, on 8.2) SeaMonkey now consistenly reports:

"Data Transfer Interrupted
The connection to forums.freebsd.org has terminated unexpectedly. Some 
data may have been transferred."

.. which I found pretty weird as I'd read this post - also not reachable 
now, of course - at 03:20 this morning, ie 17:20 UTC on 13th May:
https://forums.freebsd.org/threads/virtualbox-4-3-26-wont-start.51341/

I checked 'forums.freebsd.org' at 
https://www.ssllabs.com/ssltest/analyze.html?d=forums.freebsd.org which 
is currently showing: "The server supports only older protocols, but not 
the current best TLS 1.2. Grade capped to B."

That report also shows "Valid from Tue, 12 May 2015 00:00:00 UTC
Valid until Tue, 17 May 2016 23:59:59 UTC (expires in 1 year)"

although my successful access at 03:20 this morning above was over 41 
hours later than that Server Key and Certificate #1 date.

Hopefully a temporary glitch, though I rarely refer to the forums.  No 
similar issue with https://www.freebsd.org/ luckily (a matter of time?)

cheers, Ian

Hello

I checked now by sslLabs.com:
https://www.ssllabs.com/ssltest/analyze.html?d=forums.freebsd.org

and score is A+

But I don't think disable TLS 1.0 is ok.

In test result paragraph: Handshake Simulation is informations that
page will not work on:
- Android 4.3 (and older)
- IE 6,7,8 on XP/Vista
- IE 8-10 on Win7 (TLS > 1.0 is disabled in default browser config)
- old Java


Very nice Web browser Secure protocols table:

https://en.wikipedia.org/wiki/Transport_Layer_Security#Web_browsers


Best Regards.

On 14 mai 2015, at 12:02, Ian Smith wrote:
> Well, I can't reach https://forums.freebsd.org/ at all at the moment,
my
> (admittedly ancient, on 8.2) SeaMonkey now consistenly reports:
> 
> "Data Transfer Interrupted
> The connection to forums.freebsd.org has terminated unexpectedly. Some 
> data may have been transferred."
looks like your browser/OS does not support TLS 1.2.

> I checked 'forums.freebsd.org' at 
> https://www.ssllabs.com/ssltest/analyze.html?d=forums.freebsd.org which 
> is currently showing: "The server supports only older protocols, but
not
> the current best TLS 1.2. Grade capped to B."

I've printed the report as PDF:

http://patpro.net/~patpro/SSL-Server-Test-forums.freebsd.org.pdf

You can see what I see : grade A+, TLS 1.2 only, hence poor support for old
browser (more like old openssl)

regards,
patpro