{"action":"created","issue":{"url":"https://api.github.com/repos/mozilla/fxa-bugzilla-mirror/issues/80","repository_url":"https://api.github.com/repos/mozilla/fxa-bugzilla-mirror","labels_url":"https://api.github.com/repos/mozilla/fxa-bugzilla-mirror/issues/80/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/fxa-bugzilla-mirror/issues/80/comments","events_url":"https://api.github.com/repos/mozilla/fxa-bugzilla-mirror/issues/80/events","html_url":"https://github.com/mozilla/fxa-bugzilla-mirror/issues/80","id":115239439,"number":80,"title":"FxA and sync servers get a \"B\" on SSLlabs tests [bz1219547]","user":{"login":"rfk","id":34695,"avatar_url":"https://avatars3.githubusercontent.com/u/34695?v=4","gravatar_id":"","url":"https://api.github.com/users/rfk","html_url":"https://github.com/rfk","followers_url":"https://api.github.com/users/rfk/followers","following_url":"https://api.github.com/users/rfk/following{/other_user}","gists_url":"https://api.github.com/users/rfk/gists{/gist_id}","starred_url":"https://api.github.com/users/rfk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rfk/subscriptions","organizations_url":"https://api.github.com/users/rfk/orgs","repos_url":"https://api.github.com/users/rfk/repos","events_url":"https://api.github.com/users/rfk/events{/privacy}","received_events_url":"https://api.github.com/users/rfk/received_events","type":"User","site_admin":false},"labels":[{"id":287309556,"url":"https://api.github.com/repos/mozilla/fxa-bugzilla-mirror/labels/waffle:backlog","name":"waffle:backlog","color":"ededed","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2015-11-05T09:11:28Z","updated_at":"2017-12-15T16:31:32Z","closed_at":null,"author_association":"OWNER","body":"From https://bugzilla.mozilla.org/show_bug.cgi?id=1219547\n\nThe core servers for the FxA connected experience all get a \"B\" rating from SSLLabs, e.g:\n\n  https://www.ssllabs.com/ssltest/analyze.html?d=accounts.firefox.com\n  https://www.ssllabs.com/ssltest/analyze.html?d=token.services.mozilla.com\n\nThe reason it gives is that:\n\n  \"This server supports weak Diffie-Hellman (DH) key exchange parameters.\n   Grade capped to B.\"\n\nSadly I don't think we can do anything about that yet, but I wanted a bug on file to track it (and to point at when this topic comes up again).\n\nThe reasoning behind the current situation is that we have certain clients (e.g. old android devices, partner devices like Bug 1186900) that do not support the \"modern\" TLS configuration recommended in [1].  Instead we must use the \"intermediate\" configuration [2] which includes DH ciphers.\n\nThese ciphers are fine _if_ you use secure DH parameters.  But the TLS support for FxA and Sync is provided by Amazon's Elastic Load Balancers, which don't let you customize the DH parameters.\n\nSo I think we're stuck on a \"B\" grade until all our clients grow more modern TLS support, or Amazon gives us better tools to customize TLS on the ELBs.\n\n[1] https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility\n[2] https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28default.29\n"},"comment":{"url":"https://api.github.com/repos/mozilla/fxa-bugzilla-mirror/issues/comments/352049948","html_url":"https://github.com/mozilla/fxa-bugzilla-mirror/issues/80#issuecomment-352049948","issue_url":"https://api.github.com/repos/mozilla/fxa-bugzilla-mirror/issues/80","id":352049948,"user":{"login":"vbudhram","id":1295288,"avatar_url":"https://avatars0.githubusercontent.com/u/1295288?v=4","gravatar_id":"","url":"https://api.github.com/users/vbudhram","html_url":"https://github.com/vbudhram","followers_url":"https://api.github.com/users/vbudhram/followers","following_url":"https://api.github.com/users/vbudhram/following{/other_user}","gists_url":"https://api.github.com/users/vbudhram/gists{/gist_id}","starred_url":"https://api.github.com/users/vbudhram/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vbudhram/subscriptions","organizations_url":"https://api.github.com/users/vbudhram/orgs","repos_url":"https://api.github.com/users/vbudhram/repos","events_url":"https://api.github.com/users/vbudhram/events{/privacy}","received_events_url":"https://api.github.com/users/vbudhram/received_events","type":"User","site_admin":false},"created_at":"2017-12-15T16:31:32Z","updated_at":"2017-12-15T16:31:32Z","author_association":"NONE","body":"from mtg: closing this for now"}}
{"actor":{"display_login":"vbudhram"}}