3

I am in progress of trying to get maximum (or almost maximum) score on SSL Labs my site:

I currently don't understand why it does not give me full Key exchange score.

Now, it looks like this:

SSL Labs Key exchange < 100%

In spite of, I have generated 4096 DHParameters file, and tried many other things, like buying new certificate of 4096 size.

So, my question for you will be:

SSL Labs Key exchange is less than 100%, why? And how do I make it full?

OS: GNU/Linux Debian 9.2 with Apache 2.4.

  • 3
    You got an A+ but that isn't good enough? At some point you have to stop optimizing. – Stephen Ostermiller Nov 26 '17 at 14:05
5

In the following file:

/etc/apache2/mods-enabled/ssl.conf

It was necessary to append these lines to ensure the highest grade of key exchange:

SSLOpenSSLConfCmd ECDHParameters Automatic

SSLOpenSSLConfCmd Curves secp521r1:secp384r1


UPDATE 2018-Apr-14

I found out, that (at least Chrome, read more on this topic here), decided to go for lower Key Exchange negotiation, namely P-256 (prime256v1 in Apache2, though SSL Labs reports it like secp256r1) in spite of me having set the above curves.

So, I guess we should add P-256 to the list; please change the second line to:

SSLOpenSSLConfCmd Curves secp521r1:secp384r1:prime256v1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.