[Wt-interest] Forward secrecy for wthttpd

[Rutger ter Borg]

Deal all,

I'm using a wthttpd instance to serve a Wt app. I used
https://www.ssllabs.com/ to test the quality of its security settings.
So far, the highest achievable of wthttpd is an A-, because wthttpd is
not forcing forward secrecy upon clients that do support them, but do
not prefer them. The DH param option already helps, but is not sufficient.

My guess is that wthttpd will get proper support for forward secrecy if
server-side ciphers are preferred (and use the ones that use Ephemeral
Diffie-Hellman, DHE). The following would fix this:

Modify http/Configuration:

* add a sslPreferServerCiphers() (a boolean) option

Modify http/Server, around // HTTPS and int sslOptions:

if ( config.sslPreferServerCiphers() ) {
SSL_CTX_set_option( native_ctx, SSL_OP_CIPHER_SERVER_PREFERENCE );
}

Thanks,

Rutger

[Rutger ter Borg]

Dear all,

I got it to work, and added a pull request.

Cheers,

Rutger

Post by Rutger ter Borg
Deal all,
I'm using a wthttpd instance to serve a Wt app. I used
https://www.ssllabs.com/ to test the quality of its security settings.
So far, the highest achievable of wthttpd is an A-, because wthttpd is
not forcing forward secrecy upon clients that do support them, but do
not prefer them. The DH param option already helps, but is not sufficient.
My guess is that wthttpd will get proper support for forward secrecy if
server-side ciphers are preferred (and use the ones that use Ephemeral
* add a sslPreferServerCiphers() (a boolean) option
if ( config.sslPreferServerCiphers() ) {
SSL_CTX_set_option( native_ctx, SSL_OP_CIPHER_SERVER_PREFERENCE );
}
Thanks,
Rutger

[K. Frank]

Hello Rutger (and List)!

Just an FYI:

All of your witty-interest posts are getting sent to my gmail
spam folder. (I don't use any special settings.)

I think in an earlier thread of yours Koen might have replied
to my reply instead of directly to your original post, so maybe
others on the list are seeing the same problem.

(I know that yahoo mail has a dumb setting that causes mailing
list traffic from yahoo addresses to get flagged as spam, but I
don't see any reason that your posts should get flagged.)


Best.


K. Frank

Post by Rutger ter Borg
Dear all,
I got it to work, and added a pull request.
...