{"action":"closed","issue":{"url":"https://api.github.com/repos/openwrt/openwrt/issues/415","repository_url":"https://api.github.com/repos/openwrt/openwrt","labels_url":"https://api.github.com/repos/openwrt/openwrt/issues/415/labels{/name}","comments_url":"https://api.github.com/repos/openwrt/openwrt/issues/415/comments","events_url":"https://api.github.com/repos/openwrt/openwrt/issues/415/events","html_url":"https://github.com/openwrt/openwrt/issues/415","id":212789504,"number":415,"title":"uhttpd ssl fails certificate check because weak methods available","user":{"login":"olmari","id":5422161,"avatar_url":"https://avatars2.githubusercontent.com/u/5422161?v=3","gravatar_id":"","url":"https://api.github.com/users/olmari","html_url":"https://github.com/olmari","followers_url":"https://api.github.com/users/olmari/followers","following_url":"https://api.github.com/users/olmari/following{/other_user}","gists_url":"https://api.github.com/users/olmari/gists{/gist_id}","starred_url":"https://api.github.com/users/olmari/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/olmari/subscriptions","organizations_url":"https://api.github.com/users/olmari/orgs","repos_url":"https://api.github.com/users/olmari/repos","events_url":"https://api.github.com/users/olmari/events{/privacy}","received_events_url":"https://api.github.com/users/olmari/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-03-08T16:45:01Z","updated_at":"2017-03-08T20:05:27Z","closed_at":"2017-03-08T20:05:27Z","body":"@jow- \r\n\r\nOpenWrt Designated Driver 50104 / LuCI Master (git-17.046.32957-dea880e)\r\n\r\nCertificate with RSA key uhttpd (compiled with luci-ssl-openssl) offers insecure methods thus even having valid certificate it will fail on browsers that raises red flag with any weak component existing (like Chrome).\r\n\r\nMain culprits are SSL/TLS compression\tand RC4. Both should be disabled in order to not raise red flags (ssllabs analyze also confirms). So one should at least disable cipher suites TLS_RSA_WITH_RC4_128_MD5 (0x4)  and TLS_RSA_WITH_RC4_128_SHA (0x5), and not use ssl compression (enabling CRIME attack).\r\n\r\nAs a warning (but not a failure, yet at least) Perfect forward secrecy is also not supported, would be cool to have, but not red flag at this stage. As attachments screenshots from ssllabs test against openwrt uhttpd setup:\r\n![overall grade](https://cloud.githubusercontent.com/assets/5422161/23713644/3f457c4c-042f-11e7-8248-430ac0e89aa3.png)\r\n![rc4](https://cloud.githubusercontent.com/assets/5422161/23713645/3f4afe74-042f-11e7-9405-a3ab1a409699.png)\r\n![protocol details](https://cloud.githubusercontent.com/assets/5422161/23713643/3f3b20f8-042f-11e7-9a80-758139c7bf36.png)\r\n\r\nAlso uhttpd doesn't seem to support certificates with EC-key? Tough that also isn't directly a show-stopper for now :)"}}
{"actor":{"display_login":"olmari"}}