SLL Tips and Tricks

Diffie_Hellman Key

cd /etc/ssl/certs openssl dhparam -out dhparam.pem 4096 Then it needs to be added to Nginx main configuration file:
ssl_dhparam /etc/ssl/certs/dhparam.pem;


Openssl Command Lines

Get information from CSR
Certificate Signing Request, read a CSR:
openssl req -noout -text -in file.csr X509 certificat an encoded block of text composed of a public key and some information defining it. Commonly its extension is « .crt » or « .pem ».
Read information of a certificate file:
openssl x509 -text -noout -in certificate.crt

A few information contained in a certificate in addition to the public key:
Certificat Version(« Version ») ; Serial Number (« Serial Number ») ; Signing entity identity (« Issuer ») ; Validity time window (« Validity »): (« Not Before ») and (« Not After ») ; Subject of the key (« Subject ») information given when requesting the certificate (country, organization, contact email...) ; Key size (« Public-Key ») ; Key usage (« Key Usage » et « Extended Key Usage ») ; Signing key fingerprint and its subject (respectively « Subject Key Identifier » and « Authority Key Identifier ») ; Alternative Names (« Subject Alternative Name ») ; Is the certificate one of and certification authority? (« CA:FALSE » for no, in « Basic Constraints ») ; Revocation List access (« CRL Distribution Points »). Sources: sslshopper.com - testssl.sh/


Openssl Connect

Connect SSL Client to a Server in debug mode, getting Certificate and encryption information:
openssl s_client -connect -debug $FQDN:PORT (NO Protocol prefix) openssl s_client -connect HOST:443



Openssl Cypher

openssl enc -e -aes-256-cbc -in keys.tar.gz -out keys.tar.gz.enc openssl enc -d -aes-256-cbc -in infos.txt.enc -out tmp


HTTPS-HSTS

Nginx config file

Declaring combinations of cyper suites from the strongest to the weakest (all on one line):
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE ssl_prefer_server_ciphers on; ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384: ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM: ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384: ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256: DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA: DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK'; ssl_dhparam /etc/ssl/certs/dhparam.pem;

HTTPS-HSTS in virtual host file

ssl_certificate /path/to/fullchain.pem; ssl_certificate_key /path/to/privkey.pem; ssl_session_cache shared:SSL:10m; ssl_session_timeout 10m; keepalive_timeout 60; ssl_ciphers HIGH:!aNULL:!MD5; ssl_prefer_server_ciphers on; add_header Strict-Transport-Security "max-age=31536000; includeSubdomains";