在 SSL Labs 上拿到 Perfect Score (完全滿分的 A+)

在「Achieving a Perfect SSL Labs Score with Go」這邊提到要如何在 Go 上面達到 SSL LabsSSL Server Test 的 Perfect Score (完全滿分的 A+),但其實裡面大多數的東西都應該適用於其他地方。

其中 Cipher Strength 這邊讓人非常意外的是,只有在關閉 HTTP/2 的情況下才有可能達到 100%,因為 HTTP/2 規定強制要支援 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,而這是 128bits cipher,會導致無法達到 100%:

No HTTP/2 for you! - HTTP/2 was enabled by default in go 1.6, however HTTP/2 mandates the support of the cipher suite TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256. As this is a 128bit cipher, it needs to be removed. The only way to achieve a perfect score now is to disable HTTP/2.

這被點出來後不知道會有什麼改變... (無論是 HTTP/2 或是 SSL Labs)

One thought on “在 SSL Labs 上拿到 Perfect Score (完全滿分的 A+)”

  1. 即使拿到滿分,也不代表就沒問題。

    實務考量相容性後,也可能拿不到滿分。

Leave a Reply

Your email address will not be published. Required fields are marked *