Hacker News Reader

Comment by realusername | Hacker News Reader

Here is my Nginx config for let's encrypt on my case, feel free to criticize or copy it: https://gist.github.com/alex-min/158f35f604b24e163ae9. I've managed to get a A+ on the ssllab test so it should not be too bad I believe (but I'm not an expert so if you have some idea for improvements, I would be glad).

View on HN

Here is my configuration: https://github.com/majewsky/system-configuration/blob/master...

Domains with this configuration get A+ on ssllabs and securityheaders.io (test with "repo.holocm.org" if you like). It includes an autorenewal script wrapped in a systemd timer unit.

There is one bug, though: The autorenewal script fails because letsencrypt crashes when stdin is not a TTY. ( https://github.com/letsencrypt/letsencrypt/issues/2523 )

You should also add HPKP (leaf pinning), it insanly powerful and a challange to get right. I have not figured out why the damn ssllabs complains about it to me.

I wanted to add it but I've seen all these warnings on the Internet about it and I'm not so sure I will be able to manage it if it does not work as expected. I've added X-Frame-Options, Strict-Transport-Security, X-Xss-Protection and X-Content-Type-Options because they have very few side-effects but I'm a bit afraid of HPKP.

I have the same problem, if I use one of the HPKP generators (or copy-paste a 'correct' example & substitute my cert hashes) I always get the SSL Labs error. Everything else is perfect. Depending on what guide I follow, I get Nginx errors, SSL Labs errors, or other third-party test errors. Never a consensus, which is what I would expect once everything is 100% correct.

I'll have to set aside a few more hours to figure this out soon. Even good documentation like this is not working for me: https://developer.mozilla.org/en-US/docs/Web/Security/Public...

Reply on news.ycombinator.com