Encrypting connections.
WHAT IT PROVIDES
- Confidentiality: traffic cannot be read
- Integrity: traffic cannot be altered undetected
- Authentication: the server is who it claims
WHAT IT DOES NOT PROVIDE
Any indication that the site is honest or safe.
WHAT THE HANDSHAKE ESTABLISHES
An agreed cipher suite The server's identity, through its certificate Shared keys for the session
WHAT FORWARD SECRECY MEANS
Session keys that cannot be recovered later, even if the server's private key is compromised.
WHY THAT MATTERS
Recorded traffic cannot be decrypted retrospectively.
WHAT THE CURRENT VERSION IMPROVED
Fewer round trips Removal of obsolete and weak options Resumption with reduced overhead
WHAT TO DISABLE
Every version before the current two Weak ciphers and key exchanges
WHAT TO ENABLE
Current versions only, with strong suites.
WHAT THE SERVER NAME INDICATION DOES
Tells the server which site is wanted, so many can share an address.
WHAT IT DISCLOSES
The hostname, unencrypted, unless the encrypted variant is used.
WHAT TO TEST
Your configuration, using an external assessment tool.
