3

I am in progress of trying to get maximum (or almost maximum) score on SSL Labs my site:

I currently don't understand why it does not give me full Key exchange score.

Now, it looks like this:

SSL Labs Key exchange < 100%

In spite of, I have generated 4096 DHParameters file, and tried many other things, like buying new certificate of 4096 size.

So, my question for you will be:

SSL Labs Key exchange is less than 100%, why? And how do I make it full?

OS: GNU/Linux Debian 9.2 with Apache 2.4.

Improve this question
1
  • 3
    You got an A+ but that isn't good enough? At some point you have to stop optimizing.
    – Stephen Ostermiller ♦
    Commented Nov 26, 2017 at 14:05

1 Answer 1

Reset to default
5

In the following file:

/etc/apache2/mods-enabled/ssl.conf

It was necessary to append these lines to ensure the highest grade of key exchange:

SSLOpenSSLConfCmd ECDHParameters Automatic


SSLOpenSSLConfCmd Curves secp521r1:secp384r1

UPDATE 2018-Apr-14

I found out, that (at least Chrome, read more on this topic here), decided to go for lower Key Exchange negotiation, namely P-256 (prime256v1 in Apache2, though SSL Labs reports it like secp256r1) in spite of me having set the above curves.

So, I guess we should add P-256 to the list; please change the second line to:

SSLOpenSSLConfCmd Curves secp521r1:secp384r1:prime256v1
Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.