SSL Testssl results?

I just did a clean install of centmin mod 09beta with php 7.0.8 Nginx 1.11.1 and got this result via testssl.

Code:

[root@localhost centminmod]# testssl https://sslspdy.com

No engine or GOST support via engine with your /usr/bin/openssl

###########################################################
    testssl       2.6 from https://testssl.sh/
    (c7c259b 2016-06-26 15:44:23 -- 1.379B)

      This program is free software. Distribution and
             modification under GPLv2 permitted.
      USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!

       Please file bugs @ https://testssl.sh/bugs/

###########################################################

Using "OpenSSL 1.0.1e-fips 11 Feb 2013" [~121 ciphers] on
localhost.localdomain:/usr/bin/openssl
(built: "May  9 08:07:32 2016", platform: "linux-x86_64")


Testing now (2016-06-26 17:33) ---> 192.184.89.66:443 (sslspdy.com) <---

further IP addresses:   2604:180:1::fd2c:e402
rDNS (192.184.89.66):   sslspdy.com.
Service detected:       HTTP


--> Testing protocols (via sockets except TLS 1.2 and SPDY/NPN)

SSLv2      not offered (OK)
SSLv3      not offered (OK)
TLS 1      offered
TLS 1.1    offered
TLS 1.2    offered (OK)
SPDY/NPN   h2, spdy/3.1, http/1.1 (advertised)

--> Testing ~standard cipher lists

Null Ciphers                 not offered (OK)
Anonymous NULL Ciphers       not offered (OK)
Anonymous DH Ciphers         not offered (OK)
40 Bit encryption            not offered (OK)
56 Bit encryption            Local problem: No 56 Bit encryption configured in /usr/bin/openssl
Export Ciphers (general)     not offered (OK)
Low (<=64 Bit)               not offered (OK)
DES Ciphers                  not offered (OK)
Medium grade encryption      not offered (OK)
Triple DES Ciphers           not offered (OK)
High grade encryption        offered (OK)

--> Testing (perfect) forward secrecy, (P)FS -- omitting 3DES, RC4 and Null Encryption here

PFS is offered (OK)  ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES256-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES128-SHA

--> Testing server preferences

Has server cipher order?     nope (NOT ok)
Negotiated protocol          TLSv1.2
Negotiated cipher            ECDHE-ECDSA-AES256-GCM-SHA384,  (limited sense as client will pick)
Negotiated cipher per proto  (limited sense as client will pick)
     ECDHE-ECDSA-AES128-SHA:        TLSv1, TLSv1.1
     ECDHE-ECDSA-AES256-GCM-SHA384: TLSv1.2, spdy/3.1
No further cipher order check has been done as order is determined by the client

--> Testing server defaults (Server Hello)

TLS server extensions        renegotiation info, EC point formats, session ticket, status request
Session Tickets RFC 5077     600 seconds
Server key size              EC 256 bit
Signature Algorithm          ECDSA with SHA256
Fingerprint / Serial         SHA1 155AA462E9EBFC2C608D18AB83DD32C17245C89A / 6F2CECA22E73F3FFA5266435705B5390
                              SHA256 91A3930E8F38C7B1EBBC265953B8773E888544BD7C45F5A6927AF50D80D31C11
Common Name (CN)             *.sslspdy.com (wildcard certificate match) (CN in response to request w/o SNI: *.sslspdy.com)
subjectAltName (SAN)         *.sslspdy.com sslspdy.com
Issuer                       COMODO ECC Domain Validation Secure Server CA (COMODO CA Limited from GB)
EV cert (experimental)       no
Certificate Expiration       >= 60 days (2014-10-24 00:00 --> 2016-10-23 23:59 +0000)
# of certificates provided   3
Certificate Revocation List  http://crl.comodoca.com/COMODOECCDomainValidationSecureServerCA.crl
OCSP URI                     http://ocsp.comodoca.com
OCSP stapling                offered
TLS timestamp                random values, no fingerprinting possible


--> Testing HTTP header response @ "/"

HTTP Status Code             200 OK
HTTP clock skew              -1464583849 sec from localtime
Strict Transport Security    365 days=31536000 s, includeSubDomains
Public Key Pinning           # of keys: 2, 604800 s = 7 days (<30 days is not good enough), includeSubDomains
                              matching host key: QYBZo54E74EGPmprgubrqe39L01K0kkNQBfJ6hRFUyE
Server banner                nginx centminmod
Application banner           X-Powered-By: centminmod
Cookie(s)                    (none issued at "/")
Security headers             --
Reverse Proxy banner         --


--> Testing vulnerabilities

Heartbleed (CVE-2014-0160)                not vulnerable (OK)
CCS (CVE-2014-0224)                       not vulnerable (OK)
Secure Renegotiation (CVE-2009-3555)      not vulnerable (OK)
Secure Client-Initiated Renegotiation     not vulnerable (OK)
CRIME, TLS (CVE-2012-4929)                not vulnerable (OK)
BREACH (CVE-2013-3587)                    NOT ok: uses gzip HTTP compression (only "/" tested)
POODLE, SSL (CVE-2014-3566)               not vulnerable (OK)
TLS_FALLBACK_SCSV (RFC 7507), experim.    Downgrade attack prevention supported (OK)
FREAK (CVE-2015-0204)                     not vulnerable (OK) (tested with 4/9 ciphers)
LOGJAM (CVE-2015-4000), experimental      not vulnerable (OK) (tested w/ 2/4 ciphers only!), common primes not checked.
BEAST (CVE-2011-3389)                     no CBC ciphers for TLS1 (OK)
RC4 (CVE-2013-2566, CVE-2015-2808)        no RC4 ciphers detected (OK)


--> Testing all locally available 121 ciphers against the server, ordered by encryption strength
    (Your /usr/bin/openssl cannot show DH/ECDH bits)

Hexcode  Cipher Suite Name (OpenSSL)    KeyExch.   Encryption Bits        Cipher Suite Name (RFC)
-----------------------------------------------------------------------------------------------------------------------
xc02c   ECDHE-ECDSA-AES256-GCM-SHA384  ECDH       AESGCM     256         TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384    
xc024   ECDHE-ECDSA-AES256-SHA384      ECDH       AES        256         TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384    
xc02b   ECDHE-ECDSA-AES128-GCM-SHA256  ECDH       AESGCM     128         TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256    
xc023   ECDHE-ECDSA-AES128-SHA256      ECDH       AES        128         TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256    
xc009   ECDHE-ECDSA-AES128-SHA         ECDH       AES        128         TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA      


Done now (2016-06-26 17:34) ---> 192.184.89.66:443 (sslspdy.com) <---

---

 

I guess I should update openssl on my system. I wish CentOS would update their stock version of Openssl.

 

I did an upgrade to 1.0.2h on the system and I was getting some "Local Problems" - do the local problems mean that there were issues with the install or that since the items are missing, that it passes the test because they're not there to begin with? I couldn't find anything while searching online for "Local Problems".

Code:

###########################################################
    testssl       2.6 from https://testssl.sh/
    (1.379B 2015/09/25 12:35:41)

      This program is free software. Distribution and
             modification under GPLv2 permitted.
      USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!

       Please file bugs @ https://testssl.sh/bugs/

###########################################################

Using "OpenSSL 1.0.2h  3 May 2016" [~125 ciphers] on
localhost.localdomain:/usr/bin/openssl
(built: "reproducible build, date unspecified", platform: "linux-x86_64")


Testing now (2016-06-27 05:24) ---> 192.184.89.66:443 (sslspdy.com) <---

further IP addresses:   2604:180:1::fd2c:e402
rDNS (192.184.89.66):   sslspdy.com.
Service detected:       HTTP


--> Testing protocols (via sockets except TLS 1.2 and SPDY/NPN)

SSLv2      not offered (OK)
SSLv3      not offered (OK)
TLS 1      offered
TLS 1.1    offered
TLS 1.2    offered (OK)
SPDY/NPN   h2, spdy/3.1, http/1.1 (advertised)

--> Testing ~standard cipher lists

Null Ciphers                 not offered (OK)
Anonymous NULL Ciphers       not offered (OK)
Anonymous DH Ciphers         not offered (OK)
40 Bit encryption            Local problem: No 40 Bit encryption configured in /usr/bin/openssl
56 Bit encryption            Local problem: No 56 Bit encryption configured in /usr/bin/openssl
Export Ciphers (general)     Local problem: No Export Ciphers (general) configured in /usr/bin/openssl
Low (<=64 Bit)               Local problem: No Low (<=64 Bit) configured in /usr/bin/openssl
DES Ciphers                  Local problem: No DES Ciphers configured in /usr/bin/openssl
Medium grade encryption      not offered (OK)
Triple DES Ciphers           not offered (OK)
High grade encryption        offered (OK)

--> Testing (perfect) forward secrecy, (P)FS -- omitting 3DES, RC4 and Null Encryption here

PFS is offered (OK)  ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES256-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES128-SHA

--> Testing server preferences

Has server cipher order?     nope (NOT ok)
Negotiated protocol          TLSv1.2
Negotiated cipher            ECDHE-ECDSA-AES256-GCM-SHA384, 256 bit ECDH (limited sense as client will pick)
Negotiated cipher per proto  (limited sense as client will pick)
Local problem: /usr/bin/openssl doesn't support "s_client -ssl2"
     ECDHE-ECDSA-AES128-SHA:        TLSv1, TLSv1.1
     ECDHE-ECDSA-AES256-GCM-SHA384: TLSv1.2, spdy/3.1
No further cipher order check has been done as order is determined by the client

--> Testing server defaults (Server Hello)

TLS server extensions        renegotiation info, EC point formats, session ticket, status request
Session Tickets RFC 5077     600 seconds
Server key size              EC 256 bit
Signature Algorithm          ECDSA with SHA256
Fingerprint / Serial         SHA1 155AA462E9EBFC2C608D18AB83DD32C17245C89A / 6F2CECA22E73F3FFA5266435705B5390
                              SHA256 91A3930E8F38C7B1EBBC265953B8773E888544BD7C45F5A6927AF50D80D31C11
Common Name (CN)             *.sslspdy.com (wildcard certificate match) (CN in response to request w/o SNI: *.sslspdy.com)
subjectAltName (SAN)         *.sslspdy.com sslspdy.com
Issuer                       COMODO ECC Domain Validation Secure Server CA (COMODO CA Limited from GB)
EV cert (experimental)       no
Certificate Expiration       >= 60 days (2014-10-24 00:00 --> 2016-10-23 23:59 +0000)
# of certificates provided   3
Certificate Revocation List  http://crl.comodoca.com/COMODOECCDomainValidationSecureServerCA.crl
OCSP URI                     http://ocsp.comodoca.com
OCSP stapling                offered
TLS timestamp                random values, no fingerprinting possible


--> Testing HTTP header response @ "/"

HTTP Status Code             200 OK
HTTP clock skew              -1464583848 sec from localtime
Strict Transport Security    365 days=31536000 s, includeSubDomains
Public Key Pinning           # of keys: 2, 604800 s = 7 days (<30 days is not good enough), includeSubDomains
                              matching host key: QYBZo54E74EGPmprgubrqe39L01K0kkNQBfJ6hRFUyE
Server banner                nginx centminmod
Application banner           X-Powered-By: centminmod
Cookie(s)                    (none issued at "/")
Security headers             --
Reverse Proxy banner         --


--> Testing vulnerabilities

Heartbleed (CVE-2014-0160)                not vulnerable (OK)
CCS (CVE-2014-0224)                       not vulnerable (OK)
Secure Renegotiation (CVE-2009-3555)      not vulnerable (OK)
Secure Client-Initiated Renegotiation     not vulnerable (OK)
CRIME, TLS (CVE-2012-4929)                Local problem: /usr/bin/openssl lacks zlib support
BREACH (CVE-2013-3587)                    NOT ok: uses gzip HTTP compression (only "/" tested)
POODLE, SSL (CVE-2014-3566)               not vulnerable (OK)
TLS_FALLBACK_SCSV (RFC 7507), experim.    Downgrade attack prevention supported (OK)
FREAK (CVE-2015-0204)                     Local problem: /usr/bin/openssl doesn't have any EXPORT RSA ciphers configured
LOGJAM (CVE-2015-4000), experimental      Local problem: /usr/bin/openssl doesn't have any DHE EXPORT ciphers configured
BEAST (CVE-2011-3389)                     no CBC ciphers for TLS1 (OK)
RC4 (CVE-2013-2566, CVE-2015-2808)        no RC4 ciphers detected (OK)


--> Testing all locally available 125 ciphers against the server, ordered by encryption strength

Hexcode  Cipher Suite Name (OpenSSL)    KeyExch.   Encryption Bits        Cipher Suite Name (RFC)
-----------------------------------------------------------------------------------------------------------------------
xc02c   ECDHE-ECDSA-AES256-GCM-SHA384  ECDH 256   AESGCM     256         TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
xc024   ECDHE-ECDSA-AES256-SHA384      ECDH 256   AES        256         TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
xc02b   ECDHE-ECDSA-AES128-GCM-SHA256  ECDH 256   AESGCM     128         TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
xc023   ECDHE-ECDSA-AES128-SHA256      ECDH 256   AES        128         TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
xc009   ECDHE-ECDSA-AES128-SHA         ECDH 256   AES        128         TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA


Done now (2016-06-27 05:25) ---> 192.184.89.66:443 (sslspdy.com) <---

Also, I was curious that the below was ok in your output but "nope" in both my stock install and the upgraded 1.0.2h tests? How did you get that to be ok on your end?

Code:

Has server cipher order?    nope (NOT ok)

 

I was testing it out on CentOS 7.2 w/ 09beta. I installed testssl via yum. Didn't specify any specific config options when I built openssl.

I was following a tut located here: How to Install the latest OpenSSL 1.0.2h Version on CentOS 6/7 | BIP media

I also read some posts on stackexchange and serverfault where some people were saying not to upgrade openssl on Centos 7.2 that there were going to be issues.

I was really just testing this to see if I could get a clean output from the testssl. Maybe I should just ditch upgrading and stick with the default 1.0.1.

 

Do you have any suggestions about what I should use for the config? Or should I just leave it alone and run with the stock centos 7 openssl for my server? What are your recommendations?