ssl sessions are for tls1.0 (disabled in your config) tls1.2 uses tls tickets for resumption
what does ssl labs say on tls tickets ? сб, 12 июн. 2021 г. в 05:51, Shawn Heisey <[email protected]>: > I'm fiddling with ssl labs to see how I can improve my TLS setup. > > Here's what they say about a site I have behind haproxy with TLS: > > > https://www.elyograg.org/foo/haproxy-ssllabs-session-resumption-not-working.png > > They claim that session resumption isn't working. I'm hoping that I've > just done something wrong... which will be bad for my ego but great for > getting problems fixed. I did have the option to disable tls tickets, > but when I took it out, my ssl labs grade didn't go down, so it's still > not there. > > This is what I have in the global section: > > global > log 127.0.0.1 len 65535 format rfc5424 local0 > log 127.0.0.1 len 65535 format rfc5424 local1 notice > maxconn 4096 > daemon > spread-checks 2 > tune.bufsize 65536 > tune.http.logurilen 49152 > tune.ssl.cachesize 100000 > tune.ssl.lifetime 900 > ssl-server-verify none > tune.ssl.default-dh-param 2048 > ssl-default-bind-ciphers EECDH+AESGCM:EDH+AESGCM > ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11 > ssl-default-server-ciphers > RC4-MD5:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES128-SHA:AES256-SHA:AES256-SHA256 > stats socket /etc/haproxy/stats.socket > > I don't think there's anything else in the config that could affect > this, but if there is something that would help diagnose, let me know. > > Here's info about haproxy, which I compiled from source: > > root@smeagol:~# haproxy -vv > HAProxy version 2.4.0-6cbbecf 2021/05/14 - https://haproxy.org/ > Status: long-term supported branch - will stop receiving fixes around Q2 > 2026. > Known bugs: http://www.haproxy.org/bugs/bugs-2.4.0.html > Running on: Linux 5.8.0-55-generic #62~20.04.1-Ubuntu SMP Wed Jun 2 > 08:55:04 UTC 2021 x86_64 > Build options : > TARGET = linux-glibc > CPU = native > CC = cc > CFLAGS = -O2 -march=native -g -Wall -Wextra > -Wdeclaration-after-statement -fwrapv -Wno-address-of-packed-member > -Wno-unused-label -Wno-sign-compare -Wno-unused-parameter -Wno-clobbered > -Wno-missing-field-initializers -Wno-cast-function-type -Wtype-limits > -Wshift-negative-value -Wshift-overflow=2 -Wduplicated-cond > -Wnull-dereference > OPTIONS = USE_PCRE_JIT=1 USE_OPENSSL=1 USE_ZLIB=1 USE_SYSTEMD=1 > DEBUG = > > Feature list : +EPOLL -KQUEUE +NETFILTER -PCRE +PCRE_JIT -PCRE2 > -PCRE2_JIT +POLL -PRIVATE_CACHE +THREAD -PTHREAD_PSHARED +BACKTRACE > -STATIC_PCRE -STATIC_PCRE2 +TPROXY +LINUX_TPROXY +LINUX_SPLICE +LIBCRYPT > +CRYPT_H +GETADDRINFO +OPENSSL -LUA +FUTEX +ACCEPT4 -CLOSEFROM +ZLIB > -SLZ +CPU_AFFINITY +TFO +NS +DL +RT -DEVICEATLAS -51DEGREES -WURFL > +SYSTEMD -OBSOLETE_LINKER +PRCTL +THREAD_DUMP -EVPORTS -OT -QUIC -PROMEX > -MEMORY_PROFILING > > Default settings : > bufsize = 16384, maxrewrite = 1024, maxpollevents = 200 > > Built with multi-threading support (MAX_THREADS=64, default=4). > Built with OpenSSL version : OpenSSL 1.1.1f 31 Mar 2020 > Running on OpenSSL version : OpenSSL 1.1.1f 31 Mar 2020 > OpenSSL library supports TLS extensions : yes > OpenSSL library supports SNI : yes > OpenSSL library supports : TLSv1.0 TLSv1.1 TLSv1.2 TLSv1.3 > Built with network namespace support. > Built with zlib version : 1.2.11 > Running on zlib version : 1.2.11 > Compression algorithms supported : identity("identity"), > deflate("deflate"), raw-deflate("deflate"), gzip("gzip") > Built with transparent proxy support using: IP_TRANSPARENT > IPV6_TRANSPARENT IP_FREEBIND > Built with PCRE version : 8.39 2016-06-14 > Running on PCRE version : 8.39 2016-06-14 > PCRE library supports JIT : yes > Encrypted password support via crypt(3): yes > Built with gcc compiler version 9.3.0 > > Available polling systems : > epoll : pref=300, test result OK > poll : pref=200, test result OK > select : pref=150, test result OK > Total: 3 (3 usable), will use epoll. > > Available multiplexer protocols : > (protocols marked as <default> cannot be specified using 'proto' > keyword) > h2 : mode=HTTP side=FE|BE mux=H2 > flags=HTX|CLEAN_ABRT|HOL_RISK|NO_UPG > fcgi : mode=HTTP side=BE mux=FCGI > flags=HTX|HOL_RISK|NO_UPG > <default> : mode=HTTP side=FE|BE mux=H1 flags=HTX > h1 : mode=HTTP side=FE|BE mux=H1 > flags=HTX|NO_UPG > <default> : mode=TCP side=FE|BE mux=PASS flags= > none : mode=TCP side=FE|BE mux=PASS > flags=NO_UPG > > Available services : none > > Available filters : > [SPOE] spoe > [CACHE] cache > [FCGI] fcgi-app > [COMP] compression > [TRACE] trace > >
