Improving our SSL setup

Following an announcement about improvements to their SSL setup, the text discusses the complexities of deploying forward secrecy and updating cipher lists, emphasizing the importance of supporting TLS 1.2 to enable further enhancements. It addresses the transition away from the RC4 cipher due to vulnerabilities, favoring AES GCM for its broader support and security. The text explores the role of session resumption in forward secrecy, contrasting session IDs, where the server tracks state, with session tickets, which encrypt state information and facilitate sharing across servers. In the context of GitHub, session tickets were initially enabled by default due to HAProxy's settings, leading to potential security concerns if the session ticket key were compromised. Ultimately, the decision was made to disable session tickets and rely on session IDs to ensure forward secrecy while maintaining performance, recognizing the limitations of session tickets in their specific setup. The contribution of Jeff Hodges in identifying initial setup oversights is acknowledged.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.