From ebf80753b684509d3a2b8c1d7165a104ab549d51 Mon Sep 17 00:00:00 2001
From: Paul Duncan <pabs@pablotron.org>
Date: Thu, 21 Oct 2021 17:55:17 -0400
Subject: add posts/2021-10-21-tls-and-header-fixes.md
---
content/posts/2021-10-21-tls-and-header-fixes.md | 102 +++++++++++++++++++++
.../tls-and-header-fixes/lighthouse-desktop.png | Bin 0 -> 23026 bytes
.../posts/tls-and-header-fixes/securityheaders.png | Bin 0 -> 47353 bytes
.../files/posts/tls-and-header-fixes/ssllabs.png | Bin 0 -> 55230 bytes
4 files changed, 102 insertions(+)
create mode 100644 content/posts/2021-10-21-tls-and-header-fixes.md
create mode 100644 static/files/posts/tls-and-header-fixes/lighthouse-desktop.png
create mode 100644 static/files/posts/tls-and-header-fixes/securityheaders.png
create mode 100644 static/files/posts/tls-and-header-fixes/ssllabs.png
diff --git a/content/posts/2021-10-21-tls-and-header-fixes.md b/content/posts/2021-10-21-tls-and-header-fixes.md
new file mode 100644
index 0000000..430561d
--- /dev/null
+++ b/content/posts/2021-10-21-tls-and-header-fixes.md
@@ -0,0 +1,102 @@
+---
+slug: tls-and-header-fixes
+title: "TLS and Header Fixes"
+date: "2021-10-21T10:22:04-04:00"
+draft: true
+---
+Yesterday I scanned this site using the following tools:
+
+* [SSL Labs: SSL Server Test][ssllabs]: [TLS][] version,
+ [cipher suites][cipher-suite], and security headers scanner.
+* [Security Headers][securityheaders]: [HTTP][] response security
+ headers scanner.
+* [Lighthouse][lighthouse]: Page performance and accessibility scanner.
+
+I made a several [Apache][] configuration changes based on the
+initial scan results:
+
+1. Disabled ancient versions of [TLS][].
+2. Set an explicit [cipher suite list][cipher-suite] using the
+ [Mozilla SSL Configuration Generator][ssl-config-gen].
+3. Refined the value of the `Access-Control-Allow-Origin` header.
+4. Added two new headers: `Referrer-Policy` and `Permissions-Policy`.
+
+After a couple of iterations of changes and testing, I:
+
+* Updated [my recent post][response-header-post] to reflect the
+ response header changes in the [Apache][] configuration.
+* Applied the same changes (with minor tweaks) to several other
+ sites.
+
+**Tip:** Use the [Mozilla SSL Configuration Generator][ssl-config-gen]
+to generate your [TLS][] configuration. It has three client profiles
+("modern", "intermediate", and "old") and supports a variety of servers
+(web, email, database, application, etc).
+
+Random thoughts:
+* Static site generators like [Hugo][] and [Jekyll][] make it easy to
+ check off many performance and security requirements.
+* As an industry, we still have not learned to ["have one joint and keep
+ it well oiled"][lesson] when dealing with security. Notable
+ exception: [Wireguard][].
+
+Screenshots of the improved scan results are available below. Click the
+[SSL Labs][ssllabs] and [Security Headers][securityheaders] pictures to
+see the scan details.
+
+[{{< figure
+ src="/files/posts/tls-and-header-fixes/ssllabs.png"
+ class=image
+ width=990
+ height=506
+ caption="SSL Labs scan results."
+>}}][ssllabs-results]
+
+[{{< figure
+ src="/files/posts/tls-and-header-fixes/securityheaders.png"
+ class=image
+ width=1226
+ height=297
+ caption=" Security Headers scan results."
+>}}][securityheaders-results]
+
+{{< figure
+ src="/files/posts/tls-and-header-fixes/lighthouse-desktop.png"
+ class=image
+ width=488
+ height=192
+ caption="Lighthouse desktop scan results."
+>}}
+
+[ssllabs]: https://www.ssllabs.com/ssltest/
+ "TLS version, cipher suite, and response header scanner."
+[securityheaders]: https://securityheaders.com/
+ "HTTP response header scanner."
+[lighthouse]: https://developers.google.com/web/tools/lighthouse
+ "Page performance and accessibility scanner."
+[cipher-suite]: https://en.wikipedia.org/wiki/Cipher_suite
+ "Set of cryptographic algorithms."
+[tls]: https://en.wikipedia.org/wiki/Transport_Layer_Security
+ "Transport Layer Security"
+[http]: https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol
+ "HyperText Transfer Protocol"
+[apache]: https://apache.org/
+ "Apache web server."
+[response-header-post]: {{< ref "/posts/2021-10-19-hugo-csp-impedance-mismatch.md" >}}
+ "My recent post on Hugo and HTTP response headers."
+[ssl-config-gen]: https://ssl-config.mozilla.org/
+ "Mozilla SSL Configuration Generator"
+[ssllabs-results]: https://www.ssllabs.com/ssltest/analyze.html?d=pablotron.org&hideResults=on
+ "SSL Labs scan results."
+[securityheaders-results]: https://securityheaders.com/?q=pablotron.org&hide=on&followRedirects=on
+ "Security Headers scan results."
+[postgres]: https://postgresql.org/
+ "PostgreSQL relational database server."
+[lesson]: https://www.imperialviolet.org/2016/05/16/agility.html
+ "Cryptographic Agility, by Adam Langley."
+[wireguard]: https://www.wireguard.com/
+ "Wireguard VPN"
+[hugo]: https://gohugo.io/
+ "Hugo static site generator."
+[jekyll]: https://jekyllrb.com/
+ "Jekyll static site generator."
diff --git a/static/files/posts/tls-and-header-fixes/lighthouse-desktop.png b/static/files/posts/tls-and-header-fixes/lighthouse-desktop.png
new file mode 100644
index 0000000..de4af02
Binary files /dev/null and b/static/files/posts/tls-and-header-fixes/lighthouse-desktop.png differ
diff --git a/static/files/posts/tls-and-header-fixes/securityheaders.png b/static/files/posts/tls-and-header-fixes/securityheaders.png
new file mode 100644
index 0000000..219d17b
Binary files /dev/null and b/static/files/posts/tls-and-header-fixes/securityheaders.png differ
diff --git a/static/files/posts/tls-and-header-fixes/ssllabs.png b/static/files/posts/tls-and-header-fixes/ssllabs.png
new file mode 100644
index 0000000..75aed43
Binary files /dev/null and b/static/files/posts/tls-and-header-fixes/ssllabs.png differ
--
cgit v1.2.3