Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

As the title sugests, is it possible to disable SSL / TLS Renegotiation when hosting a RoR application or Heroku?

I ran the Nessus security tool on my website and the only serious warning showing up is that the website is possibly open to DoS attacks.

enter image description here

I tried researching the problem, but I'm not sure if it is a heroku problem or the thin server or if the issue is because of the rails application.

Are there any solutions to this issue?

Any advice would be appreciated.

share|improve this question

If you're using SSL endpoints for your application on Heroku, the encryption is terminated at Heroku's SSL load balancer, and not on (rack + thin/puma/etc) Rails itself.

For what it's worth, I don't see anything published by Heroku stating that it's possible for individuals to disable TLS session renegotiation on their endpoints, so if you want this additional level of security, you'll need to stand up your own SSL termination reverse proxy (like nginx or something) and put in front of your Heroku endpoint.

share|improve this answer
    
I think you accidentally a few words at the end. – ceejayoz Aug 10 '15 at 16:45
    
thanks @ceejayoz, was writing this and realized i hadn't auth'ed to ServerFault vs StackOverflow and missed part of my copy/paste I guess. – Mike Atlas Aug 11 '15 at 15:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.