Hey, everyone.
And welcome back.
Now in today's video, we will look into the grading aspect of the SSL, TLS configuration that we might
be making in a Web server.
Now, do remember that just by getting an SSL, TLS certificate and using the Https website is not the
ultimate goal.
And many of the organizations that do that, they get the Https certificate, they modify the server
configuration, and you have the Https website and they say, okay, now we are all secure.
But that is not the final goal.
Now setting the right web server level configuration for your SSL.
TLS is one of the very important thing that you need to do.
So there are a lot of important configurations that you can make in your web server to improve the overall
implementation.
So you can have things like ocsp stapling, you can have perfect forward secrecy, you can set the recommended
allowed ciphers as well as the allowed SSL TLS version.
You can have the Hsts, which is the Http, strict transport security and various others.
So along with having the right SSL, TLS certificates and then also making the right configuration setting
within your web server, together they will improve the overall security of your website.
Now there are various websites which you can use to grade your certificate as well as the configurations
of your web server.
So through the GUI it becomes much more easier where let's say you have a Https website, you can just
put your website name and the grader will go through it.
It will look into the configurations and it can rate you.
So A-plus is generally the highest rating and certain websites even get F, so if you grade through
this, it will become much more easier for you to understand whether your configurations are idle or
they are not up to the mark.
So let's quickly look into one of the websites which allows you to understand these aspects.
So one of the very good website is SSL Labs.
So it is SSL labs, dot com slash SSL test.
All right.
So this is the website.
So what you have to do is you have to basically put your hostname where your Https website is running.
So once you do that, you can go ahead and click submit.
So now what it will do is it will automatically verify your configurations, it will check your certificates
and depending on both of those aspects, it will grade your website.
So it is just testing various things.
So let's quickly wait for a moment here.
Great.
So the evaluation has been completed.
And if you see the overall rating is a which is quite good.
Now if you go a bit down, it basically shows you a lot of aspects over here.
So let's go a bit up and let's do one thing.
Let's open up this website in one more tab.
Let's click on Test Your Server.
And now here you will see that there are various other websites.
It basically tells you the list of websites which has either better rating or even worse rating.
So there is a website here.
So it has an A+ rating, which is quite good.
So let's open this up and we'll also look into certain other websites which does not have a good rating.
So let's open one of them.
So these are some random websites here.
You see, even Labs dot internal has been tested here and it is a so you see there are a lot of administrators
who test their websites against the quality SSL labs because this is very useful.
So speaking about Unix storm.org.
So this is one of the random websites.
So it really got a.
Now if you look over here, this website has http strict transport security, which is hsts.
And this is something that we were discussing.
This is one of the ways in which you can improve your overall security as well as the overall grade.
So this same thing is not really there in labs or internal, and this is one of the reasons why it does
not have the highest rating.
So here the highest rating is A+.
So this is the reason why you should always test your implementation in the sites like this so that
you can have the overall analysis.
Now speaking.
About one of the websites.
Let's look into why this really got F.
So it basically says here you see it even has the hsts, but it's still got an F, So it is not like
you just have the Hsts and you'll get the highest grade.
So here it says that this server is vulnerable to the drown attack.
So now if you go a bit down it will show you the exact section and also give you a better details.
Now there are various attacks that happens against TLS or SSL.
You have Poodle, which is specifically for SSL version three.
You have Beast Attack, you have various others.
So if one of them might be applicable for your website, you will immediately get a downgraded rating.
Now, let me quickly show you one interesting thing here.
So within your Nginx configuration, you have a include directory.
So this is basically the include directory, which got automatically added after Letsencrypt.
So let me open this up in our Nano editor.
So within here you can set the SSL protocol.
So currently if you would see that the SSL protocols by default which were allowed was TLS version one,
1.1, 1.2.
So you can override that.
You can say that only the SSL protocol of TLS 1.2 would be allowed.
No other would be allowed here.
All right.
So this is something that you can configure.
So now let's try one thing.
Let's also allow the SSL version three.
So once you have done that, you can go ahead and save this.
Let's verify with Nginx and let's go ahead and restart the Nginx.
Great.
So once you have done that, let's go ahead and clear the cache.
So that it can scan the website again.
All right.
So the analysis is complete.
And now you see, just because the SSL version three was allowed by the Web server, the rating came
down from A to C.
Now you see this server.
It says that this server is vulnerable to the poodle attack.
Now, poodle attack is specifically for the SSL version three.
And this is one of the reasons why you have the later versions like TLS, which were released.
So I hope you understood about the improvement that you might want to make when you deploy the SSL,
TLS for your website.
So that's the high level overview.
I hope this video has been informative for you and I look forward to see you in the next video.