0

In the next months we plan/need to refresh our https certificate and update our server OS version.

We are thinking about switching to Let's Encrypt.

It would be inacceptable, if clients could not access our https-API. Clients also include for example other webservers running on Java7.

I don't know, if upgrading the server OS to a more uptodate one would make any difference (ciphersuites etc.?). Planned proxy might be nginx, but this is not fix yet.

Is it possible/what to watch out for/best practicies/recommondations/alternatives?

Edit: To make it more clear: I can set up test servers and for example try accessing it in my webbrowser but I don't have access to all clients accessing the website because those clients are run/developed by other companies. I worry about wether clients like Firefox/Java7 webserver/Internet Explorer/etc. will have problems accessing the website. Clients are written by the companies using them.

Edit2: From the nature of our site, we can assume that all client-software access the website at least once per week (normally each day) and we can install monitoring software like wireshark on the server if nescessary if it helps.

7
  • There are good servers like ssllabs.com/ssltest and htbridge.com/ssl which can be used to verify your TLS server. SslLabs test by Qualys can be used to verify which old computer systems should be able to access your web site.
    – Oleg
    Apr 28, 2016 at 20:21
  • @Oleg very helpful sites. Do you know if they also verify the truststore of the client?
    – H. Idden
    Apr 28, 2016 at 21:45
  • I' mot sure what you mean. As far I know the root certificate used by Let's encrypted (CN = DST Root CA X3, O = Digital Signature Trust Co.) is trusted by all systems. Let's encrypt is relatively new, but there are already millions of SSL server over the world which use it. I still recommend you to search more about the trust. Do you know some real system (test client) which you want to test? By the way, do you verified your current web site in ssllabs.com/ssltest? Which rating it get?
    – Oleg
    Apr 28, 2016 at 22:02
  • @Oleg Current rating: not so good because TLS 1.2 is not supported but supports SSL 2, etc. which is the reason we want to upgrade. Like I wrote not all clients are browsers but for example Java7 applications like Tomcat/JBoss or PHP using our API and I heared some clients like Firefox or Java bring there own truststore which define which CAs are trusted.
    – H. Idden
    Apr 29, 2016 at 8:43
  • I'm still not full understand the problem. First of all one have to disable SSL 3, SSL 2 and RC4 today. All legacy systems support TLS 1.0 at least. Which web server exactly you use and in which version? Mozilla SSL Configuration Generator allows you easy to generate configuration for the most cases. "Intermediate" profile supports typically the most legacy clients too (inclusive Windows XP IE8, Android 2.3, Java 7). It seems to me that you have too many opened questions. I recommend you to install test server and to play different scenarios on the server.
    – Oleg
    Apr 29, 2016 at 8:53

1 Answer 1

1

If your clients are not updated browsers (or are not browsers at all), it is not sure that Letsencrypt's root certificate is configured on their side since it is pretty recent. On that issue, there is not much you can do from your side; the clients have to do their job and ensure that the root certificate used by Letsencrypt is configured.

I tried Letsencrypt and it works fine. Here is a tip btw. Instead of letting Letsencrypt reconfigure your webserver, just ask it to generate the certificates.

I used the following command to perform this:

${LETSENCRYPT_DIR}/letsencrypt-auto" \
certonly --standalone --agree-tos --redirect \
--duplicate --text --email <email here> -d <domain here> \
--config-dir "${CERTIFICATES_DIR}"

UPDATED ANSWER FOLLOWING EXCHANGE

4
  • Creating a test server is not much problem. My worries are about wether the clients will have problems connecting to the server because I can't test all clients (Will they trust the new certificate/support ciphersuites/...?)
    – H. Idden
    Apr 28, 2016 at 19:31
  • Could you specify what works fine?
    – H. Idden
    Apr 28, 2016 at 19:39
  • Ah... yes, now I understand your concern... If your clients are not updated browsers (or are not browsers at all), it is not sure that Letsencrypt's root certificate is configured on their side. On that issue, there is not much you can do from your side; the clients have to do their job and ensure that the root certificate used by Letsencrypt is configured. You have to check if Letsencrypt's root certificate is already installed on the clients, if you know what they are currently running. BTW, what works fine was accessing my webserver with my browser. Apr 28, 2016 at 19:58
  • @H.Idden: also if your client pins your service against your certificate fingerprint, or your CA certificate, then they'd not trust the new certificate.
    – Lie Ryan
    Apr 29, 2016 at 1:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .