1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
|
<!doctype html>
<html>
<head>
<meta charset="utf-8" />
<title>Generate Mozilla Security Recommended Web Server Configuration Files</title>
<link rel="stylesheet" type="text/css" media="all" href="../css/screen.css" />
<link href="//mozorg.cdn.mozilla.net/media/css/tabzilla-min.css" rel="stylesheet" />
<style>
div#server-config-text pre {
background-color: #F7F7F7;
border-radius: 3px;
padding: 2em;
}
label, p {
font-family: 'Open Sans', "Lucida Sans", "Lucida Grande", "Lucida Sans Unicode", Verdana, sans-serif;
font-weight: normal;
text-shadow: 0px 1px 0px rgba(255, 255, 255, 0.75);
}
.message {
font-size: 150%;
}
pre {
overflow-x: auto;
}
</style>
<script src="//ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js"></script>
<script src="//cdnjs.cloudflare.com/ajax/libs/handlebars.js/2.0.0/handlebars.min.js"></script>
<script src="//mozorg.cdn.mozilla.net/tabzilla/tabzilla.js"></script>
<script>
// https://gist.github.com/cowboy/566233
var isSemVer=(function(){var a=/^(<|>|[=!<>]=)?\s*(\d+(?:\.\d+){0,2})([a-z][a-z0-9\-]*)?$/i;function b(e,c){var d=(e+"").match(a);return d?(c?(d[1]||"=="):"")+'"'+(d[2]+".0.0").match(/\d+(?:\.\d+){0,2}/)[0].replace(/(?:^|\.)(\d+)/g,function(g,f){return Array(9-f.length).join(0)+f;})+(d[3]||"~")+'"':(c?"==0":1);}return function(e){e=b(e);for(var c,d=1;c=arguments[d++];){if(!(new Function("return "+e+b(c,1)))()){return false;}}return true;};})();
// isSemVer says "1.0.1 > 1.0.1e" and isOpenSSLSemVer says "1.0.1 < 1.0.1e". isOpenSSLSemVer is needed to accommodate OpenSSL's version grammar
var isOpenSSLSemVer=(function(){var a=/^(<|>|[=!<>]=)?\s*(\d+(?:\.\d+){0,2})([a-z][a-z0-9\-]*)?$/i;function b(e,c){var d=(e+"").match(a);return d?(c?(d[1]||"=="):"")+'"'+(d[2]+".0.0").match(/\d+(?:\.\d+){0,2}/)[0].replace(/(?:^|\.)(\d+)/g,function(g,f){return Array(9-f.length).join(0)+f;})+(d[3]||"")+'"':(c?"==0":1);}return function(e){e=b(e);for(var c,d=1;c=arguments[d++];){if(!(new Function("return "+e+b(c,1)))()){return false;}}return true;};})();
</script>
<script>
if (window.location.protocol != "https:")
window.location.href = "https:" + window.location.href.substring(window.location.protocol.length);
</script>
<script id="nginx-template" type="text/x-handlebars-template">
<h2>{{server}} {{serverVersion}} | {{securityProfile}} profile | OpenSSL {{opensslVersion}} | <a href="?{{queryString}}">link</a></h2>
<p>Oldest compatible clients : {{clientList}}</p>
<pre>
server {
{{listen}}
# certs sent to the client in SERVER HELLO are concatenated in ssl_certificate
ssl_certificate /path/to/signed_cert_plus_intermediates;
ssl_certificate_key /path/to/private_key;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
{{dhparam}}
# {{securityProfile}} configuration. tweak to your needs.
ssl_protocols {{sslProtocols}};
ssl_ciphers '{{cipherSuites}}';
ssl_prefer_server_ciphers on;
{{hsts}}
{{ocspstapling}}
resolver <IP DNS resolver>;
....
}
</pre>
</script>
<script id="apache-template" type="text/x-handlebars-template">
<h2>{{server}} {{serverVersion}} | {{securityProfile}} profile | OpenSSL {{opensslVersion}} | <a href="?{{queryString}}">link</a></h2>
<p>Oldest compatible clients : {{clientList}}</p>
<pre>
<VirtualHost *:443>
...
SSLEngine on
{{certFile}}
SSLCertificateKeyFile /path/to/private/key
SSLCACertificateFile /path/to/all_ca_certs
# {{securityProfile}} configuration, tweak to your needs
SSLProtocol {{sslProtocols}}
SSLCipherSuite {{cipherSuites}}
SSLHonorCipherOrder on
{{compression}}
{{ocspStapling}}
{{hsts}}
...
</VirtualHost>
{{ocspStaplingCache}}
</pre>
</script>
<script id="haproxy-template" type="text/x-handlebars-template">
<h2>{{server}} {{serverVersion}} | {{securityProfile}} profile | OpenSSL {{opensslVersion}} | <a href="?{{queryString}}">link</a></h2>
<p>Oldest compatible clients : {{clientList}}</p>
<span class="message">{{message}}</span>
<pre style="visibility: {{visibility}};">
global
# set default parameters to the {{securityProfile}} configuration
tune.ssl.default-dh-param {{maxDHKeySize}}
ssl-default-bind-ciphers {{cipherSuites}}
frontend ft_test
mode http
bind 0.0.0.0:443 {{sslProtocols}} crt /path/to/<cert+privkey+intermediate+dhparam>
{{hsts}}
</pre>
</script>
<script>
var profiles = {
modern: {
cipherSuite: 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK',
sslProtocols: {
apache: 'all -SSLv2 -SSLv3 -TLSv1',
nginx: 'TLSv1.1 TLSv1.2',
haproxy: 'ssl no-sslv3 no-tlsv10'
},
clientList: 'Firefox 27, Chrome 22, IE 11, Opera 14, Safari 7, Android 4.4, Java 8',
maxDHKeySize: '2048',
messages: []
},
intermediate: {
cipherSuite: 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA',
sslProtocols: {
apache: 'all -SSLv2 -SSLv3',
nginx: 'TLSv1 TLSv1.1 TLSv1.2',
haproxy: 'ssl no-sslv3'
},
clientList: 'Firefox 1, Chrome 1, IE 7, Opera 5, Safari 1, Windows XP IE8, Android 2.3, Java 7',
maxDHKeySize: '1024',
messages: []
},
old: {
cipherSuite: 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA',
sslProtocols: {
apache: 'all -SSLv2',
nginx: 'SSLv3 TLSv1 TLSv1.1 TLSv1.2',
haproxy: 'ssl'
},
clientList: 'Windows XP IE6, Java 6',
maxDHKeySize: '1024',
messages: []
}
};
var messageTypes = {
oldOpenSSL: 'TLS v1.1 and v1.2 support is only present in OpenSSL 1.0.1 and newer',
oldApache: 'TLS v1.1 and v1.2 support is only present in Apache 2.4 and newer'
};
function getVersionConstrainedDirectives(data) {
switch (data.server) {
case "nginx":
// http://nginx.org/en/docs/http/ngx_http_core_module.html
if (isSemVer(data.serverVersion, ">=0.7.2")) {
data.dhparam = '\n # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits' + '\n' +
' ssl_dhparam /path/to/dhparam.pem;';
}
if (isSemVer(data.serverVersion, ">=1.3.7")) {
data.ocspstapling = '\n # OCSP Stapling ---' + '\n' +
' # fetch OCSP records from URL in ssl_certificate and cache them' + '\n' +
' ssl_stapling on;' + '\n' +
' ssl_stapling_verify on;' + '\n' +
'\n' +
' ## verify chain of trust of OCSP response using Root CA and Intermediate certs' + '\n' +
' ssl_trusted_certificate /path/to/root_CA_cert_plus_intermediates;';
}
if (data.hstsEnabled == "true") {
data.hsts = '\n # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)' + '\n' +
' add_header Strict-Transport-Security max-age=15768000;';
}
if (isSemVer(data.serverVersion, ">=0.7.14")) {
data.listen = ' listen 443 ssl;';
} else {
data.listen = ' listen 443;' + '\n' +
' ssl on;';
}
break;
case "apache":
// http://httpd.apache.org/docs/current/mod/mod_ssl.html
data.compression = isSemVer(data.serverVersion, ">=2.4.3") ? ' SSLCompression off' : '';
if (isOpenSSLSemVer(data.opensslVersion, ">=0.9.8h") && isSemVer(data.serverVersion, '>=2.3.3')) {
data.ocspStapling = '\n # OCSP Stapling, only in httpd 2.3.3 and later' + '\n' +
' SSLUseStapling on' + '\n' +
' SSLStaplingResponderTimeout 5' + '\n' +
' SSLStaplingReturnResponderErrors off';
data.ocspStaplingCache = 'SSLStaplingCache shmcb:/var/run/ocsp(128000)' + '\n';
}
if (isSemVer(data.serverVersion, '>=2.4.8')) {
data.certFile = ' SSLCertificateFile /path/to/signed_certificate_followed_by_intermediate_certs';
} else {
data.certFile = ' SSLCertificateFile /path/to/signed_certificate\n' +
' SSLCertificateChainFile /path/to/intermediate_certificate';
}
if (data.hstsEnabled == "true") {
data.hsts = '\n # HSTS (mod_headers is required) (15768000 seconds = 6 months)' + '\n' +
' Header always add Strict-Transport-Security "max-age=15768000"';
}
if (isSemVer(data.serverVersion, '>=2.3.16')) {
data.sslProtocols = data.sslProtocols.replace(' -SSLv2','');
}
break;
case "haproxy":
// http://www.haproxy.org/download/1.5/doc/configuration.txt
if (data.hstsEnabled == "true") {
data.hsts = '\n # HSTS (15768000 seconds = 6 months)' + '\n' +
' rspadd Strict-Transport-Security:\\ max-age=15768000';
}
if (isSemVer(data.serverVersion, "<1.5")) {
data.visibility = 'hidden';
data.message = "HAProxy version " + data.serverVersion + " doesn't support SSL";
}
break;
}
return data;
}
$(document).ready(function() {
function loadFromQueryString() {
// http://stackoverflow.com/a/10834119/837015
var defaults = {"server": "apache-2.2.15",
"openssl": "1.0.1e",
"hsts": "yes",
"profile": "intermediate"};
var queries = defaults;
var search = document.location.search.trim();
$.each(search.substr(1).split('&'),function(c,q){
var i = q.split('=');
queries[i[0].toString()] = i.length == 2 ? i[1].toString() : "true";
});
var server = queries["server"].split("-");
$("#server-version").val(server[1]);
$("#openssl-version").val(queries["openssl"]);
$("input#hsts-enabled").attr("checked", queries["hsts"] === "yes");
$("div#server-list input#"+server[0]).attr("checked", true);
$("div#security-profile-list input#"+queries["profile"]).attr("checked", true);
}
function toggleProfileAvailability(disableProfileTest, currentProfile, targetProfile, message) {
profileOrder = ["modern", "intermediate", "old"];
result = currentProfile;
if (disableProfileTest) {
if ($.inArray(message, profiles[targetProfile]["messages"]) == -1) {
profiles[targetProfile]["messages"].push(message);
}
if ($("#security-profile-list input#" + targetProfile).prop("disabled") == false) {
$("#security-profile-list input#" + targetProfile).prop("disabled", true);
if (currentProfile == targetProfile) {
fallbackProfile = profileOrder[(profileOrder.indexOf(targetProfile) + 1 < profileOrder.length ?
profileOrder.indexOf(targetProfile) + 1 :
0)];
$("#security-profile-list input#" + fallbackProfile).prop( "checked", true );
result = fallbackProfile;
}
}
} else {
if ($.inArray(message, profiles[targetProfile]["messages"]) != -1) {
profiles[targetProfile]["messages"].splice(profiles[targetProfile]["messages"].indexOf(message), 1);
}
}
if (profiles[targetProfile]["messages"].length == 0) {
$("#security-profile-list input#" + targetProfile).prop("disabled", false);
$("#security-profile-list label[for=" + targetProfile + "]").removeAttr("title");
} else {
$("#security-profile-list label[for=" + targetProfile + "]").attr("title", profiles[targetProfile]["messages"].join(" "));
}
return result;
}
function renderConfig() {
var data = {
serverVersion: $("#server-version").val(),
opensslVersion: $("#openssl-version").val(),
hstsEnabled: $("input#hsts-enabled:checkbox:checked").val(),
server: $("div#server-list input:radio:checked").val(),
securityProfile: $("div#security-profile-list input:radio:checked").val()
};
var source = $("#" + data.server + "-template").html();
var template = Handlebars.compile(source);
data.visibility = "visible";
jQuery.extend(data, {
sslProtocols: profiles[data.securityProfile]["sslProtocols"][data.server],
cipherSuites: profiles[data.securityProfile]["cipherSuites"],
maxDHKeySize: profiles[data.securityProfile]["maxDHKeySize"],
clientList: profiles[data.securityProfile]["clientList"],
queryString: $.param({
server: $("div#server-list input:radio:checked").val() + "-" + $("#server-version").val(),
openssl: $("#openssl-version").val(),
hsts: $("input#hsts-enabled:checkbox:checked").val() ? "yes" : "no",
profile: $("div#security-profile-list input:radio:checked").val()
})
});
jQuery.extend(data, getVersionConstrainedDirectives(data));
data.securityProfile = toggleProfileAvailability(
isOpenSSLSemVer(data.opensslVersion, "<1.0.1"),
data.securityProfile,
"modern",
messageTypes.oldOpenSSL);
data.securityProfile = toggleProfileAvailability(
data.server == "apache" && isSemVer(data.serverVersion, "<2.4.0"),
data.securityProfile,
"modern",
messageTypes.oldApache);
$("#server-config-text").html(template(data));
}
$("ul#security-profile-list li button").click(function() {
securityProfile = $(this).text();
renderConfig();
});
$("input").change(function() {
renderConfig();
});
loadFromQueryString();
renderConfig();
});
</script>
</head>
<body>
<a href="https://www.mozilla.org/" id="tabzilla">mozilla</a>
<div id="wrapper">
<h1>Mozilla SSL Configuration Generator</h1>
<div style="width 100px; float:left; padding:1em;">
<div id="server-list">
<input type="radio" name="server" id="apache" value="apache">
<label for="apache">Apache</label>
<br />
<input type="radio" name="server" id="nginx" value="nginx">
<label for="nginx">Nginx</label>
<br />
<input type="radio" name="server" id="haproxy" value="haproxy">
<label for="haproxy">HAProxy</label>
<br />
</div>
</div>
<div style="width 100px; float:left; padding:1em;">
<div id="security-profile-list">
<input type="radio" name="security-profile" id="modern" value="modern">
<label for="modern">Modern</label>
<br />
<input type="radio" name="security-profile" id="intermediate" value="intermediate">
<label for="intermediate">Intermediate</label>
<br />
<input type="radio" name="security-profile" id="old" value="old">
<label for="old">Old</label>
<br />
</div>
</div>
<div style="width 100px; float:left; padding:1em;">
<label for="server-version">Server Version</label>
<input id="server-version" type="text" maxlength="15" />
<br />
<label for="openssl-version">OpenSSL Version</label>
<input id="openssl-version" type="text" maxlength="15" />
<br />
<label for="hsts-enabled"><a href="http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security">HSTS</a> Enabled</label>
<input id="hsts-enabled" type="checkbox" value="true" />
</div>
<div style="clear:both;"></div>
<div id="server-config-text"></div>
<div>
<p><a href="https://wiki.mozilla.org/Security/Server_Side_TLS">More details on these security profiles</a> - <a href="https://github.com/mozilla/server-side-tls">Report issues, submit pull requests and fork code here</a></p>
</div>
</div>
</body>
</html>
|
