6 ms·

For those who might not be aware, the highest SSL Labs grade is not A, but A+. To score A+ you must score A and additionally set HSTS headers with long duratio

For those who might not be aware, the highest SSL Labs grade is not A, but A+. To score A+ you must score A and additionally set HSTS headers with long duration (I use 2 years, haven't tried with less). For example, with Nginx you use something like: add_header Strict-Transport-Security "max-age=63113904;";

tptacek 11y ago
Right, and you can (and should) do this easily in Go, but it isn't a safe default.
arca_vorago 11y ago
If you use Hiawatha you get A+ with out of the box settings. Just plugging it because it constantly outperforms my expectations and PolarSSL (now mbed owned by Arm), has avoided many of the recent openssl issues making my life less worrisome, but the dev doesn't really advertise or push it and relies on word of mouth more than anything. It's worth checking out. https://www.hiawatha-webserver.org https://www.hiawatha-webserver.org
- tptacek 11y ago
  Zero is the number of TLS experts I know that would unreservedly recommend PolarSSL over Go's crypto/tls. I know several who wouldn't even recommend it over OpenSSL, but it's worth remembering that not only does Go's TLS not use OpenSSL, but it's curated by one of the world's experts in TLS security. Go has one of the best TLS stacks in the world, and I expect the distinction to become starker in the future; in a few years, barring something unexpected from something like BoringSSL, it may end up being unquestioned best TLS stack.
  - lazyjones 11y ago
    > Go has one of the best TLS stacks in the world, Go suffers a bit from weak random numbers though (crypto/rand Read() output), says dieharder at least: http://nopaste.narf.at/show/31060/ http://nopaste.narf.at/show/31060/ I'm not sure how severe that is...
    - tptacek 11y ago
      Horseshit. Go's crypto reads from urandom, just like Nacl.
  - arca_vorago 11y ago
    Thanks for the info tptacek, do you have any reading along these lines that goes into any detail on this? From what I have been reading go tls is nice but computationally more intensive. I really like to go for the best wherever I can, so I am genuinely interested if anyone else has any input on this.
  - faeron 11y ago
    Go has one of the best TLS stacks in the world Do you have any proof to support this claim?
- currysausage 11y ago
  > If you use Hiawatha you get A+ with out of the box settings. Which means they set long HSTS by default, which will bite you quite badly if you're not ready yet for an irreversible HTTPS rollout. But yeah, A+ looks awesome on comparison tables, doesn't it?
  - faeron 11y ago
    No, it does not set a HSTS header by default. And the out of the box rating is A, not A+. However, with a simple setting you enable the HSTS header, which gives you the A+ rating.
- faeron 11y ago
  The dev has tried to push it, but it seemed that nobody cares. See https://www.hiawatha-webserver.org/forum/topic/2063/#10728 https://www.hiawatha-webserver.org/forum/topic/2063/#10728

tptacek 11y ago

Right, and you can (and should) do this easily in Go, but it isn't a safe default.

arca_vorago 11y ago

If you use Hiawatha you get A+ with out of the box settings. Just plugging it because it constantly outperforms my expectations and PolarSSL (now mbed owned by Arm), has avoided many of the recent openssl issues making my life less worrisome, but the dev doesn't really advertise or push it and relies on word of mouth more than anything. It's worth checking out. https://www.hiawatha-webserver.org https://www.hiawatha-webserver.org

tptacek 11y ago
Zero is the number of TLS experts I know that would unreservedly recommend PolarSSL over Go's crypto/tls. I know several who wouldn't even recommend it over OpenSSL, but it's worth remembering that not only does Go's TLS not use OpenSSL, but it's curated by one of the world's experts in TLS security. Go has one of the best TLS stacks in the world, and I expect the distinction to become starker in the future; in a few years, barring something unexpected from something like BoringSSL, it may end up being unquestioned best TLS stack.
- lazyjones 11y ago
  > Go has one of the best TLS stacks in the world, Go suffers a bit from weak random numbers though (crypto/rand Read() output), says dieharder at least: http://nopaste.narf.at/show/31060/ http://nopaste.narf.at/show/31060/ I'm not sure how severe that is...
  - tptacek 11y ago
    Horseshit. Go's crypto reads from urandom, just like Nacl.
- arca_vorago 11y ago
  Thanks for the info tptacek, do you have any reading along these lines that goes into any detail on this? From what I have been reading go tls is nice but computationally more intensive. I really like to go for the best wherever I can, so I am genuinely interested if anyone else has any input on this.
- faeron 11y ago
  Go has one of the best TLS stacks in the world Do you have any proof to support this claim?
currysausage 11y ago
> If you use Hiawatha you get A+ with out of the box settings. Which means they set long HSTS by default, which will bite you quite badly if you're not ready yet for an irreversible HTTPS rollout. But yeah, A+ looks awesome on comparison tables, doesn't it?
- faeron 11y ago
  No, it does not set a HSTS header by default. And the out of the box rating is A, not A+. However, with a simple setting you enable the HSTS header, which gives you the A+ rating.
faeron 11y ago
The dev has tried to push it, but it seemed that nobody cares. See https://www.hiawatha-webserver.org/forum/topic/2063/#10728 https://www.hiawatha-webserver.org/forum/topic/2063/#10728