Hardware wrote:Juste une précision concernant la configuration nginx, dans le cas présent ce n'est pas utile de générer les paramètres statiques DH (supprimer la directive ssl_dhparam) puisque dans la liste des ciphers il n'y a aucun algo DHE uniquement ECDHE :

ECDHE-RSA-AES128-GCM-SHA256
ECDHE-RSA-AES128-SHA256
ECDHE-RSA-AES128-SHA
ECDHE-RSA-AES256-GCM-SHA384
ECDHE-RSA-AES256-SHA384
ECDHE-RSA-AES256-SHA

Dans le cas des courbes elliptiques ECDHE, la directive ssl_ecdh_curve est suffisante. Voila, c'est toujours bon à savoir et ça fait gagner du temps.

C'est ce que j'allais dire aussi justement. Pas besoin de dhparam si ECDHE est utilisé.

Au passage, comme on en avait discuté hier soir, secp521r1 n'est pas supporté par Chrome et Internet Explorer.
Donc si vous vos sites ont vocation à être utilisé par des personnes diverses et pas forcément à la pointe de la sécurité, baisser cette valeur à secp384r1 (ECDHE 384bits, quasiment aussi sûr).

xataz wrote:Pour le faire en une commande (pratique pour des scripts d'auto génération, pour mettre à jour le cert) :

./letsencrypt-auto certonly --agree-tos -m contact@domain.tld -d mail.domain.tld -d domain.tld -d www.domain.tld

Je propose cette petite update un poil plus pratique à utiliser, et pour éviter de casser les sites trop longtemps (à moins qu'il faille faire autrement que de couper nginx qui utilise déjà le port 80 ?) :

domain=site.com; \
service nginx stop \
&& cd /root/letsencrypt \
&& ./letsencrypt-auto certonly --agree-tos --rsa-key-size 4096 -m admin@$domain -d mail.$domain -d $domain -d www.$domain \
&& service nginx start

(changer le chemin du cd par le dossier bien entendu)

Salut,

Pour apache il suffit de lancer le script comme ceci et de se laisser guider

./letsencrypt-auto --rsa-key-size 4096

L'installation du(des) certificat(s) est automatiquement faite par le script par la création d'un(des) virtualhost.

Pour la configuration manuelle en utilisant

./letsencrypt-auto certonly --rsa-key-size 4096

Il suffit ensuite d'ajouter un VirtualHost pour le https comme ceci (créer un fichier monsite-ssl.conf dans /etc/apache2/sites-available/):

<IfModule mod_ssl.c>
          <VirtualHost *:443>

                    <--------mettre ici contenu de votre virtualhost existant sans ssl------------->

                    SSLCertificateFile /etc/letsencrypt/live/<www.monsite.tld>/fullchain.pem
                    SSLCertificateKeyFile /etc/letsencrypt/live/<www.monsite.tld>/privkey.pem
                    Include /etc/letsencrypt/options-ssl-apache.conf
          </VirtualHost>
</IfModule>

Pour activer le virtualhost

a2ensite /etc/apache2/sites-available/<fichier crée> 

un petit

apache2ctl configtest

pour vérifier qu'on n'as pas fait de coquille
et un

service restart apache2

pour que apache prenne en compte les modifications.
Si jamais il se plain d'un mod ssl manquant un

a2enmod ssl

et

service apache2 restart

devrais corriger le problème.

Voila bonne navigation en https !

Merci pour ta réponse. Pour infos je me bats avec Free pour obtenir mon reverse dns. Je ne les lâche pas et j'appelle tous les 3 jours environ. Impossible d'obtenir gain de cause. Aucune explication cohérente de leur part si ce n'est que je suis sur une liste d'attente, qu'à priori il n'y a qu'une seule personne qui s’occupe de çà et que cela se fait manuellement .. Bref c'est une prise tète à chaque appel. Je suis dégouté. Pourtant lorsque je vais sur ma console (interface web) le reverse est enregistré, ce qu'ilS confirment mais il n'est pas activé. C'était pour faitre suite à nos échanges en MP et te tenir informer

Je viens de faire actuellement le tutoriel et j'ai des remarques.
CryptCheck: A+
ssllabs: A+

La, je l'ai fais sur la racine du site.

J'ai refais l'installation pour rajouter les sous domaines et tout fonctionne après des petits changements pour forcer le https.

Bonjour a tous.

Dans l'attente de validation ceci n'est pas a suivre

ayant pris la pêne de lire survolé "Let's Encrypt" help.
pour les plus rapide qui aurait passer dessus voici le contenu:

usage: 
  letsencrypt [SUBCOMMAND] [options] [-d domain] [-d domain] ...

The Let's Encrypt agent can obtain and install HTTPS/TLS/SSL certificates.  By
default, it will attempt to use a webserver both for obtaining and installing
the cert. Major SUBCOMMANDS are:

  (default) run        Obtain & install a cert in your current webserver
  certonly             Obtain cert, but do not install it (aka "auth")
  install              Install a previously obtained cert in a server
  revoke               Revoke a previously obtained certificate
  rollback             Rollback server configuration changes made during install
  config_changes       Show changes made to server config during installation
  plugins              Display information about installed plugins

optional arguments:
  -h, --help            show this help message and exit
  -c CONFIG_FILE, --config CONFIG_FILE
                        config file path (default: None)
  -v, --verbose         This flag can be used multiple times to incrementally
                        increase the verbosity of output, e.g. -vvv. (default:
                        -3)
  -t, --text            Use the text output instead of the curses UI.
                        (default: False)
  --register-unsafely-without-email
                        Specifying this flag enables registering an account
                        with no email address. This is strongly discouraged,
                        because in the event of key loss or account compromise
                        you will irrevocably lose access to your account. You
                        will also be unable to receive notice about impending
                        expiration or revocation of your certificates. Updates
                        to the Subscriber Agreement will still affect you, and
                        will be effective 14 days after posting an update to
                        the web site. (default: False)
  -m EMAIL, --email EMAIL
                        Email used for registration and recovery contact.
                        (default: None)
  -d DOMAIN, --domains DOMAIN, --domain DOMAIN
                        Domain names to apply. For multiple domains you can
                        use multiple -d flags or enter a comma separated list
                        of domains as a parameter. (default: [])
  --user-agent USER_AGENT
                        Set a custom user agent string for the client. User
                        agent strings allow the CA to collect high level
                        statistics about success rates by OS and plugin. If
                        you wish to hide your server OS version from the Let's
                        Encrypt server, set this to "". (default: None)

automation:
  Arguments for automating execution & other tweaks

  --keep-until-expiring, --keep, --reinstall
                        If the requested cert matches an existing cert, always
                        keep the existing one until it is due for renewal (for
                        the 'run' subcommand this means reinstall the existing
                        cert) (default: False)
  --expand              If an existing cert covers some subset of the
                        requested names, always expand and replace it with the
                        additional names. (default: False)
  --version             show program's version number and exit
  --renew-by-default    Select renewal by default when domains are a superset
                        of a previously attained cert (often --keep-until-
                        expiring is more appropriate). Implies --expand.
                        (default: False)
  --agree-tos           Agree to the Let's Encrypt Subscriber Agreement
                        (default: False)
  --account ACCOUNT_ID  Account ID to use (default: None)
  --duplicate           Allow making a certificate lineage that duplicates an
                        existing one (both can be renewed in parallel)
                        (default: False)

testing:
  The following flags are meant for testing purposes only! Do NOT change
  them, unless you really know what you're doing!

  --debug               Show tracebacks in case of errors, and allow
                        letsencrypt-auto execution on experimental platforms
                        (default: False)
  --no-verify-ssl       Disable SSL certificate verification. (default: False)
  --tls-sni-01-port TLS_SNI_01_PORT
                        Port number to perform tls-sni-01 challenge. Boulder
                        in testing mode defaults to 5001. (default: 443)
  --http-01-port HTTP01_PORT
                        Port used in the SimpleHttp challenge. (default: 80)
  --break-my-certs      Be willing to replace or renew valid certs with
                        invalid (testing/staging) certs (default: False)
  --test-cert, --staging
                        Use the staging server to obtain test (invalid) certs;
                        equivalent to --server https://acme-
                        staging.api.letsencrypt.org/directory (default: False)

security:
  Security parameters & server settings

  --rsa-key-size N      Size of the RSA key. (default: 2048)
  --redirect            Automatically redirect all HTTP traffic to HTTPS for
                        the newly authenticated vhost. (default: None)
  --no-redirect         Do not automatically redirect all HTTP traffic to
                        HTTPS for the newly authenticated vhost. (default:
                        None)
  --hsts                Add the Strict-Transport-Security header to every HTTP
                        response. Forcing browser to use always use SSL for
                        the domain. Defends against SSL Stripping. (default:
                        False)
  --no-hsts             Do not automatically add the Strict-Transport-Security
                        header to every HTTP response. (default: False)
  --uir                 Add the "Content-Security-Policy: upgrade-insecure-
                        requests" header to every HTTP response. Forcing the
                        browser to use https:// for every http:// resource.
                        (default: None)
  --no-uir              Do not automatically set the "Content-Security-Policy:
                        upgrade-insecure-requests" header to every HTTP
                        response. (default: None)
  --strict-permissions  Require that all configuration files are owned by the
                        current user; only needed if your config is somewhere
                        unsafe like /tmp/ (default: False)

certonly:
  Options for modifying how a cert is obtained

  --csr CSR             Path to a Certificate Signing Request (CSR) in DER
                        format; note that the .csr file *must* contain a
                        Subject Alternative Name field for each domain you
                        want certified. (default: None)

install:
  Options for modifying how a cert is deployed

revoke:
  Options for revocation of certs

rollback:
  Options for reverting config changes

  --checkpoints N       Revert configuration N number of checkpoints.
                        (default: 1)

plugins:
  Plugin options

  --init                Initialize plugins. (default: False)
  --prepare             Initialize and prepare plugins. (default: False)
  --authenticators      Limit to authenticator plugins only. (default: None)
  --installers          Limit to installer plugins only. (default: None)

paths:
  Arguments changing execution paths & servers

  --cert-path CERT_PATH
                        Path to where cert is saved (with auth --csr),
                        installed from or revoked. (default: None)
  --key-path KEY_PATH   Path to private key for cert installation or
                        revocation (if account key is missing) (default: None)
  --fullchain-path FULLCHAIN_PATH
                        Accompanying path to a full certificate chain (cert
                        plus chain). (default: None)
  --chain-path CHAIN_PATH
                        Accompanying path to a certificate chain. (default:
                        None)
  --config-dir CONFIG_DIR
                        Configuration directory. (default: /etc/letsencrypt)
  --work-dir WORK_DIR   Working directory. (default: /var/lib/letsencrypt)
  --logs-dir LOGS_DIR   Logs directory. (default: /var/log/letsencrypt)
  --server SERVER       ACME Directory Resource URI. (default:
                        https://acme-v01.api.letsencrypt.org/directory)

plugins:
  Let's Encrypt client supports an extensible plugins architecture. See
  'letsencrypt plugins' for a list of all installed plugins and their names.
  You can force a particular plugin by setting options provided below.
  Further down this help message you will find plugin-specific options
  (prefixed by --{plugin_name}).

  -a AUTHENTICATOR, --authenticator AUTHENTICATOR
                        Authenticator plugin name. (default: None)
  -i INSTALLER, --installer INSTALLER
                        Installer plugin name (also used to find domains).
                        (default: None)
  --configurator CONFIGURATOR
                        Name of the plugin that is both an authenticator and
                        an installer. Should not be used together with
                        --authenticator or --installer. (default: None)
  --apache              Obtain and install certs using Apache (default: False)
  --nginx               Obtain and install certs using Nginx (default: False)
  --standalone          Obtain certs using a "standalone" webserver. (default:
                        False)
  --manual              Provide laborious manual instructions for obtaining a
                        cert (default: False)
  --webroot             Obtain certs by placing files in a webroot directory.
                        (default: False)

apache:
  Apache Web Server - Alpha

  --apache-enmod APACHE_ENMOD
                        Path to the Apache 'a2enmod' binary. (default:
                        a2enmod)
  --apache-dismod APACHE_DISMOD
                        Path to the Apache 'a2dismod' binary. (default:
                        a2dismod)
  --apache-le-vhost-ext APACHE_LE_VHOST_EXT
                        SSL vhost configuration extension. (default: -le-
                        ssl.conf)
  --apache-server-root APACHE_SERVER_ROOT
                        Apache server root directory. (default: /etc/apache2)
  --apache-vhost-root APACHE_VHOST_ROOT
                        Apache server VirtualHost configuration root (default:
                        /etc/apache2/sites-available)
  --apache-challenge-location APACHE_CHALLENGE_LOCATION
                        Directory path for challenge configuration. (default:
                        /etc/apache2)
  --apache-handle-modules APACHE_HANDLE_MODULES
                        Let installer handle enabling required modules for
                        you.(Only Ubuntu/Debian currently) (default: True)
  --apache-handle-sites APACHE_HANDLE_SITES
                        Let installer handle enabling sites for you.(Only
                        Ubuntu/Debian currently) (default: True)

webroot:
  Webroot Authenticator

  -w WEBROOT_PATH, --webroot-path WEBROOT_PATH
                        public_html / webroot path. This can be specified
                        multiple times to handle different domains; each
                        domain will have the webroot path that preceded it.
                        For instance: `-w /var/www/example -d example.com -d
                        www.example.com -w /var/www/thing -d thing.net -d
                        m.thing.net` (default: None)

null:
  Null Installer

manual:
  Manually configure an HTTP server

  --manual-test-mode    Test mode. Executes the manual command in subprocess.
                        (default: False)
  --manual-public-ip-logging-ok
                        Automatically allows public IP logging. (default:
                        False)

standalone:
  Automatically use a temporary webserver

  --standalone-supported-challenges STANDALONE_SUPPORTED_CHALLENGES
                        Supported challenges. Preferred in the order they are
                        listed. (default: tls-sni-01,http-01)

il y a deux variantes dans le tuto officiel que j'ai rajouter
"--hsts" ici

./letsencrypt-auto certonly --rsa-key-size 4096 --hsts

et

 /etc/nginx/ssl/params.conf

voici sont contenue :

ssl_protocols TLSv1.2;     # a la place de ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA";

ssl_prefer_server_ciphers on;
ssl_ecdh_curve secp521r1;    # a la place de ssl_ecdh_curve secp384r1;

ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_session_tickets off;

add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;
          proxy_set_header X-Forwarded-For $remote_addr;             # a ajouté
          add_header Strict-Transport-Security 'max-age=31536000; includeSubdomains; preload;';            #  ajouté

                ssl_stapling        on;            # a ajout
                ssl_stapling_verify on;            # a ajout

          add_header X-Content-Type-Options nosniff;
          add_header X-XSS-Protection "1; mode=block";             # a ajouté
          add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive";            # a ajouté

arf j'avais oublier de joindre le /etc/nginx/sites-enabled/rutorrent.conf

voici le contenue j'ai mis trois utilisateur comme exemple =)

server {
   listen 80;
    server_name hostname.ws www.hostname.ws;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;

    # Drop config    
include drop.conf;

################################################################################

	index index.html index.php;
	charset utf-8;
	client_max_body_size 10M;

        ssl on;
        ssl_certificate /etc/letsencrypt/live/hostname.ws/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/hostname.ws/privkey.pem;

          ssl_trusted_certificate /etc/nginx/ssl/server.crt;


#		proxy_set_header X-Forwarded-For $remote_addr;
#	  ssl_session_cache shared:SSL:50m;
#	  ssl_session_timeout 5m;
#	  add_header Strict-Transport-Security 'max-age=31536000; includeSubdomains; preload;';
#        ssl_ecdh_curve            secp521r1;

#         add_header X-Frame-Options "DENY";
#         add_header X-Frame-Options SAMEORIGIN;
#          add_header X-Content-Type-Options nosniff;
#          add_header X-XSS-Protection "1; mode=block";
#          add_header X-Frame-Options SAMEORIGIN;
#          add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive";
#          server_tokens off;

#	include /etc/nginx/conf.d/ciphers.conf;
	access_log /var/log/nginx/rutorrent-access.log combined;
	error_log /var/log/nginx/rutorrent-error.log error;

	error_page 500 502 503 504 /50x.html;
	location = /50x.html { root /usr/share/nginx/html; }

	auth_basic "seedbox";
	auth_basic_user_file "/etc/nginx/passwd/rutorrent_passwd";

#	location = /favicon.ico {
        location = /var/www/portal/favicon.jpg {
		access_log off;
		log_not_found off;
	}

## début config accueil serveur ##   # petite modif de ma par pour vous potal = base

	location ^~ / {
	    root /var/www/portal;
            include /etc/nginx/conf.d/php.conf;
	    include /etc/nginx/conf.d/cache.conf;
	    satisfy any;
	    allow all;
	}

	location ^~ /robots.txt {
            alias /var/www/portal/robots.txt;   
	}


## fin config accueil serveur ##


## début Fast-CGI ##
	location ~ \.php$ {
                fastcgi_cache mycache;                
                fastcgi_cache_key $request_method$host$request_uri;                
                fastcgi_cache_valid any 1h;                
                include fastcgi_params;
                fastcgi_pass unix:/var/run/php5-fpm.sock;
                fastcgi_intercept_errors on;
        fastcgi_param HTTPS on;
        fastcgi_param   HTTP_SCHEME         https;

        }
## fin Fast-CGI ##

## début Fail2ban Jail ##
        location ~* \.(png|jpeg|gif|ico)$ {
                expires 1y;
                access_log off;
                try_files $uri $uri/ @rewrite;
                gzip off;
        }
        location ~* \.(mp3)$ {
                expires 1y;
                access_log off;
                gzip off;
        }
        location ~* \.(css)$ {
                expires 1d;
                access_log off;
        }
        location ~* \.(js)$ {
                expires 1h;
                access_log off;
        }
## fin Fail2ban Jail ##

	## début config rutorrent ##

	location ^~ /rutorrent {
	    root /var/www;
	    include /etc/nginx/conf.d/php.conf;
	    include /etc/nginx/conf.d/cache.conf;

	    location ~ /\.svn {
		    deny all;
	    }

	    location ~ /\.ht {
		    deny all;
	    }
	}

	location ^~ /rutorrent/conf/ {
		deny all;
	}

	location ^~ /rutorrent/share/ {
		deny all;
	}

	## fin config rutorrent ##

## début config seedbox-manager ##

        location ^~ /seedbox-manager {
            alias /var/www/seedbox-manager/public;
            include /etc/nginx//conf.d/php-manager.conf;
            include /etc/nginx//conf.d/cache.conf;
        }

## fin config seedbox-manager ##

        location /user1 {
            include scgi_params;
            scgi_pass 127.0.0.1:5001; #ou socket : unix:/home/username/.session/username.socket
            auth_basic "seedbox";
            auth_basic_user_file "/etc/nginx/passwd/rutorrent_passwd_user1";
        }

        location /user2 {
            include scgi_params;
            scgi_pass 127.0.0.1:5003; #ou socket : unix:/home/username/.session/username.socket
            auth_basic "seedbox";
            auth_basic_user_file "/etc/nginx/passwd/rutorrent_passwd_user2";
        }

        location /user3 {
            include scgi_params;
            scgi_pass 127.0.0.1:5004; #ou socket : unix:/home/username/.session/username.socket
            auth_basic "seedbox";
            auth_basic_user_file "/etc/nginx/passwd/rutorrent_passwd_user3";
        }
}

Avec ce build modifié j'ai donc sur SSL Labs un A+ et les check de CryptCheck sont bien https A+ et tls A+.

Seule problème sur Google-Chrome des problème d’accès (cela viens de ssl_ecdh_curve secp521r1 comme Wonderfall dit secp521r1 n'est pas supporté par Chrome et Internet Explorer)