Correct Apache config for xnat.rc.uab.edu

assigned to @ravi89

changed milestone to %Correct Apache config for services running under RC

changed the description

added Sprint 22-20 label and removed Sprint 22-19 label

➜ testssl.sh git:(3.1dev) ./testssl.sh xnat.rc.uab.edu

########################################################### testssl.sh 3.1dev from https://testssl.sh/dev/ (0329eba 2022-04-27 14:49:02 -- )

  This program is free software. Distribution and
         modification under GPLv2 permitted.
  USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!

   Please file bugs @ https://testssl.sh/bugs/

###########################################################

Using "OpenSSL 1.0.2-chacha (1.0.2k-dev)" [~183 ciphers] on cm-rcmbp:./bin/openssl.Darwin.x86_64 (built: "Feb 22 09:55:43 2019", platform: "darwin64-x86_64-cc")

Start 2022-10-20 15:44:17 -->> 164.111.161.113:443 (xnat.rc.uab.edu) <<--

rDNS (164.111.161.113): xnat.rc.uab.edu. Service detected: HTTP

Testing protocols via sockets except NPN+ALPN

SSLv2 not offered (OK) SSLv3 not offered (OK) TLS 1 not offered TLS 1.1 not offered TLS 1.2 offered (OK) TLS 1.3 not offered and downgraded to a weaker protocol NPN/SPDY not offered ALPN/HTTP2 not offered

Testing cipher categories

NULL ciphers (no encryption) not offered (OK) Anonymous NULL Ciphers (no authentication) not offered (OK) Export ciphers (w/o ADH+NULL) not offered (OK) LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) not offered (OK) Triple DES Ciphers / IDEA not offered Obsoleted CBC ciphers (AES, ARIA etc.) not offered Strong encryption (AEAD ciphers) with no FS not offered Forward Secrecy strong encryption (AEAD ciphers) offered (OK)

Testing server's cipher preferences

Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (IANA/RFC)

SSLv2

SSLv3

TLSv1

TLSv1.1

TLSv1.2 (server order) x9f DHE-RSA-AES256-GCM-SHA384 DH 2048 AESGCM 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 x9e DHE-RSA-AES128-GCM-SHA256 DH 2048 AESGCM 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 256 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 256 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLSv1.3

Has server cipher order? yes (OK) Negotiated protocol TLSv1.2 Negotiated cipher DHE-RSA-AES256-GCM-SHA384, 2048 bit DH

Testing robust forward secrecy (FS) -- omitting Null Authentication/Encryption, 3DES, RC4

FS is offered (OK) ECDHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-GCM-SHA256 Elliptic curves offered: secp256k1 prime256v1 secp384r1 secp521r1 DH group offered: RFC3526/Oakley Group 14 (2048 bits)

Testing server defaults (Server Hello)

TLS extensions (standard) "server name/#0" "renegotiation info/#65281" "session ticket/#35 (closed)" "heartbeat/#15 (closed)" Session Ticket RFC 5077 hint 7200 seconds, session tickets keys seems to be rotated < daily SSL Session ID support yes Session Resumption Tickets: yes, ID: yes TLS clock skew Random values, no fingerprinting possible Client Authentication none Signature Algorithm SHA256 with RSA Server key size RSA 2048 bits (exponent is 65537) Server key usage Digital Signature, Key Encipherment Server extended key usage TLS Web Server Authentication, TLS Web Client Authentication Serial 98F3ACEE7447046D8F20459C9F819F96 (OK: length 16) Fingerprints SHA1 659CE32387316045EBF93C29E62B9DC11DD7E4DA SHA256 EDC2003619E4AC1C4EAE1FCC70BA65C07F7DA37D1ED6DEFB9A8647B7EEF50DEC Common Name (CN) xnat.rc.uab.edu (CN in response to request w/o SNI: pub.rc.uab.edu ) subjectAltName (SAN) xnat.rc.uab.edu Trust (hostname) Ok via SAN and CN (SNI mandatory) Chain of trust Ok EV cert (experimental) no Certificate Validity (UTC) 101 >= 60 days (2021-12-29 00:00 --> 2023-01-29 23:59) ETS/"eTLS", visibility info not present Certificate Revocation List http://crl.incommon-rsa.org/InCommonRSAServerCA.crl OCSP URI http://ocsp.usertrust.com OCSP stapling not offered OCSP must staple extension -- DNS CAA RR (experimental) not offered Certificate Transparency yes (certificate extension) Certificates provided 4 Issuer InCommon RSA Server CA (Internet2 from US) Intermediate cert validity #1: ok > 40 days (2024-10-05 23:59). InCommon RSA Server CA <-- USERTrust RSA Certification Authority #2 (closed): ok > 40 days (2028-12-31 23:59). USERTrust RSA Certification Authority <-- AAA Certificate Services #3: ok > 40 days (2028-12-31 23:59). AAA Certificate Services <-- AAA Certificate Services Intermediate Bad OCSP (exp.) Ok

Testing HTTP header response @ "/"

HTTP Status Code 404 Not Found (Hint: supply a path which doesn't give a "404 Not Found") HTTP clock skew 0 sec from localtime Strict Transport Security not offered Public Key Pinning -- Server banner Apache Application banner -- Cookie(s) (none issued at "/") -- maybe better try target URL of 30x Security headers -- Reverse Proxy banner --

Testing vulnerabilities

Heartbleed (CVE-2014-0160) not vulnerable (OK) CCS (CVE-2014-0224) not vulnerable (OK) Ticketbleed (CVE-2016-9244), experiment. not vulnerable (OK) ROBOT Server does not support any cipher suites that use RSA key transport Secure Renegotiation (RFC 5746) supported (OK) Secure Client-Initiated Renegotiation not vulnerable (OK) CRIME, TLS (CVE-2012-4929) not vulnerable (OK) BREACH (CVE-2013-3587) no gzip/deflate/compress/br HTTP compression (OK) - only supplied "/" tested POODLE, SSL (CVE-2014-3566) not vulnerable (OK), no SSLv3 support TLS_FALLBACK_SCSV (RFC 7507) No fallback possible (OK), no protocol below TLS 1.2 offered SWEET32 (CVE-2016-2183, CVE-2016-6329) not vulnerable (OK) FREAK (CVE-2015-0204) not vulnerable (OK) DROWN (CVE-2016-0800, CVE-2016-0703) not vulnerable on this host and port (OK) make sure you don't use this certificate elsewhere with SSLv2 enabled services https://censys.io/ipv4?q=EDC2003619E4AC1C4EAE1FCC70BA65C07F7DA37D1ED6DEFB9A8647B7EEF50DEC could help you to find out LOGJAM (CVE-2015-4000), experimental common prime with 2048 bits detected: RFC3526/Oakley Group 14 (2048 bits), but no DH EXPORT ciphers BEAST (CVE-2011-3389) not vulnerable (OK), no SSL3 or TLS1 LUCKY13 (CVE-2013-0169), experimental not vulnerable (OK) Winshock (CVE-2014-6321), experimental not vulnerable (OK) - CAMELLIA or ECDHE_RSA GCM ciphers found RC4 (CVE-2013-2566, CVE-2015-2808) no RC4 ciphers detected (OK)

Running client simulations (HTTP) via sockets

Browser Protocol Cipher Suite Name (OpenSSL) Forward Secrecy

Android 4.4.2 TLSv1.2 DHE-RSA-AES256-GCM-SHA384 2048 bit DH Android 5.0.0 TLSv1.2 DHE-RSA-AES128-GCM-SHA256 2048 bit DH Android 6.0 TLSv1.2 DHE-RSA-AES128-GCM-SHA256 2048 bit DH Android 7.0 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) Android 8.1 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) Android 9.0 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) Android 10.0 (native) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) Chrome 74 (Win 10) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) Chrome 79 (Win 10) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) Firefox 66 (Win 8.1/10) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) Firefox 71 (Win 10) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) IE 6 XP No connection IE 8 Win 7 No connection IE 8 XP No connection IE 11 Win 7 TLSv1.2 DHE-RSA-AES256-GCM-SHA384 2048 bit DH IE 11 Win 8.1 TLSv1.2 DHE-RSA-AES256-GCM-SHA384 2048 bit DH IE 11 Win Phone 8.1 No connection IE 11 Win 10 TLSv1.2 DHE-RSA-AES256-GCM-SHA384 2048 bit DH Edge 15 Win 10 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) Edge 17 (Win 10) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) Opera 66 (Win 10) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) Safari 9 iOS 9 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) Safari 9 OS X 10.11 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) Safari 10 OS X 10.12 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) Safari 12.1 (iOS 12.2) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) Safari 13.0 (macOS 10.14.6) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) Apple ATS 9 iOS 9 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256) Java 6u45 No connection Java 7u25 No connection Java 8u161 TLSv1.2 DHE-RSA-AES256-GCM-SHA384 2048 bit DH Java 11.0.2 (OpenJDK) TLSv1.2 DHE-RSA-AES256-GCM-SHA384 2048 bit DH Java 12.0.1 (OpenJDK) TLSv1.2 DHE-RSA-AES256-GCM-SHA384 2048 bit DH OpenSSL 1.0.2e TLSv1.2 DHE-RSA-AES256-GCM-SHA384 2048 bit DH OpenSSL 1.1.0l (Debian) TLSv1.2 DHE-RSA-AES256-GCM-SHA384 2048 bit DH OpenSSL 1.1.1d (Debian) TLSv1.2 DHE-RSA-AES256-GCM-SHA384 2048 bit DH Thunderbird (68.3) TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256 bit ECDH (P-256)

Rating (experimental)

Rating specs (not complete) SSL Labs's 'SSL Server Rating Guide' (version 2009q from 2020-01-30) Specification documentation https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide Protocol Support (weighted) 100 (30) Key Exchange (weighted) 90 (27) Cipher Strength (weighted) 90 (36) Final Score 93 Overall Grade A Grade cap reasons Grade capped to A. HSTS is not offered

Done 2022-10-20 15:46:55 [0162s] -->> 164.111.161.113:443 (xnat.rc.uab.edu) <<--

➜ testssl.sh git:(3.1dev)

closed

unassigned @ravi89