hours, status, totalhours changed; resolution set

chris — Mon, 30 Apr 2012 13:16:32 GMT

hours changed from 0.0 to 1.0
status changed from new to closed
resolution set to fixed
totalhours changed from 0.0 to 1.0

On quince this apache config:

SSLCipherSuite HIGH

Was changed to the following for all virtual servers:

SSLHonorCipherOrder On
SSLCipherSuite RC4-SHA:HIGH:!ADH:!SSLv2:!aNULL

And the gandi intermediate cert was recreated:

wget http://crt.gandi.net/GandiStandardSSLCA.crt -O GandiStandardSSLCA.crt
wget http://crt.usertrust.com/UTNAddTrustServer_CA.crt -O UTNAddTrustServer_CA.crt
wget http://crt.usertrust.com/AddTrustExternalCARoot.crt -O AddTrustExternalCARoot.crt
openssl x509 -inform DER -in GandiStandardSSLCA.crt -out GandiStandardSSLCA.pem
openssl x509 -inform DER -in AddTrustExternalCARoot.crt -out AddTrustExternalCARoot.pem
openssl x509 -inform DER -in UTNAddTrustServer_CA.crt -out UTNAddTrustServer_CA.pem
cat GandiStandardSSLCA.pem > gandi.pem
cat UTNAddTrustServer_CA.pem >> gandi.pem
cat AddTrustExternalCARoot.pem >> gandi.pem

And the docs updated, wiki:NewLiveServer#HTTPS

For kiwi, this nginx configuration:

ssl_protocols  SSLv3 TLSv1;
ssl_ciphers  ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP;
ssl_prefer_server_ciphers   on;

Was updated to:

ssl_protocols  SSLv3 TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers  RC4-SHA:HIGH:!ADH:!SSLv2:!aNULL;
ssl_prefer_server_ciphers   on;

The nginx chained cert was recreated:

cd /etc/ssl/transitionnetwork.org
wget http://crt.gandi.net/GandiStandardSSLCA.crt -O GandiStandardSSLCA.crt
wget http://crt.usertrust.com/UTNAddTrustServer_CA.crt -O UTNAddTrustServer_CA.crt
wget http://crt.usertrust.com/AddTrustExternalCARoot.crt -O AddTrustExternalCARoot.crt
openssl x509 -inform DER -in GandiStandardSSLCA.crt -out GandiStandardSSLCA.pem
openssl x509 -inform DER -in AddTrustExternalCARoot.crt -out AddTrustExternalCARoot.pem
openssl x509 -inform DER -in UTNAddTrustServer_CA.crt -out UTNAddTrustServer_CA.pem
cat transitionnetwork.org.crt > transitionnetwork.org.chained.pem
cat GandiStandardSSLCA.pem >> transitionnetwork.org.chained.pem
cat UTNAddTrustServer_CA.pem >> transitionnetwork.org.chained.pem
cat AddTrustExternalCARoot.pem >> transitionnetwork.org.chained.pem

And now kiwi also scores a A: https://www.ssllabs.com/ssltest/analyze.html?d=kiwi%2etransitionnetwork%2eorg&s=81%2e95%2e52%2e78

And the notes here have been updated wiki:SecurityInfo

Transition Technology: Ticket #409: HTTPS Security Issues

hours, status, totalhours changed; resolution set