How to get A+ on SSL Labs

This will show how to get A+ on SSL Server Test from Qualys SSL Labs.

Enable SSL and headers module in Apache2.

a2enmod ssl
a2enmod headers

Edit Apache configuration.

SSLCertificateFile /etc/ssl/crt/«yourcert».pem
SSLCertificateKeyFile /etc/ssl/crt/«yourkey».pem
SSLCertificateChainFile /etc/ssl/crt/«intermediatechain».pem

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
SSLEngine on
SSLProtocol all -SSLv2 -SSLv3
SSLHonorCipherOrder On
SSLCipherSuite EECDH:EDH:AES:!aNULL:!eNULL:!LOW:!RC4:!3DES:!DES:!MD5:!EXP:!PSK:!SRP:!DSS

The ! preceding the cipher means that Apache will not use that cipher.

View ciphers 🔗

List the ciphers openssl supports with the current configuration.

openssl ciphers -v -ssl3 -tls1 'EECDH:EDH:AES:!aNULL:!eNULL:!LOW:!RC4:!3DES:!DES:!MD5:!EXP:!PSK:!SRP:!DSS'

Explanation 🔗

With this configuration Apache will prefer Perfect forward secrecy. If Perfect forward secrecy can’t be negotiated it will default to AES cipher. This configuration will work on all newer browser. Exceptions are older IE, older Java and a few bots.

Where there are no links to the information source it’s taken from the documentation on openssl.org.

Header always set Strict-Transport-Security 🔗

Force browser to use HTTPS even if the user enters HTTP. The browser should remember this setting for a really long time, example a year.

SSLHonorCipherOrder On 🔗

Use the servers preferred encryption not the browsers which may be a weaker cipher.

EECDH 🔗

Ephemeral elliptic-curve Diffie-Hellman, see ECDH.

EDH 🔗

Ephemeral Diffie-Hellman, see Diffie–Hellman key exchange.

AES 🔗

Advanced Encryption Standard.

!aNULL 🔗

The cipher suites offering no authentication. This is currently the anonymous DH algorithms. These cipher suites are vulnerable to a ``man in the middle'' attack and so their use is normally discouraged.

!eNULL 🔗

The «NULL» ciphers that is those offering no encryption.

!LOW 🔗

«Low» encryption cipher suites, currently those using 64 or 56 bit encryption algorithms but excluding export cipher suites.

!RC4 🔗

RC4 stream cipher. After attacks on RC4 it is said to be vulnerable. See New RC4 Attack for more information.

!3DES 🔗

Triple DES.

!DES 🔗

Data Encryption Standard.

!MD5 🔗

MD5 message-digest algorithm.

!EXP 🔗

Export encryption algorithms. Including 40 and 56 bits algorithms.

!PSK 🔗

Cipher suites using pre-shared keys (PSK).

!SRP 🔗

Secure Remote Password protocol.

!DSS 🔗

Cipher suites using DSS authentication, i.e. the certificates carry DSS keys.