Thanks, actually, I already implemented everything from that link before testing with SSLlabs + HtBridge and asking the questions in the first post.
The issue is that the options ‘eccs’ don’t get taken into use.
Here is my config:
snip...
https: [ port: 443,
otp_app: :hello_phoenix,
keyfile: "/etc/letsencrypt/live/asdf.com/privkey.pem",
certfile: "/etc/letsencrypt/live/asdf.com/cert.pem",
cacertfile: "/etc/letsencrypt/live/asdf.com/chain.pem",
versions: [:"tlsv1.2", :"tlsv1.1", :"tlsv1"],
ciphers: ~w(
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
TLS_DHE_RSA_WITH_AES_128_CBC_SHA
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
),
dhfile: "/home/asdf/projects/hello_phoenix/dh-params.pem",
secure_renegotiate: true,
reuse_sessions: true,
honor_cipher_order: true,
# http://erlang.org/doc/man/ssl.html#type-ssloption
eccs: [
:sect571r1, :sect571k1, :secp521r1, :brainpoolP512r1, :sect409k1,
:sect409r1, :brainpoolP384r1, :secp384r1, :sect283k1, :sect283r1,
:brainpoolP256r1, :secp256k1, :secp256r1, :sect239k1, :sect233k1,
:sect233r1, :secp224k1, :secp224r1
],
],
snip...
The HtBridge test results tell me that a group of ‘weak elliptic curves’ are in use. So my intention is to explicitly specify the elliptic curves that I want to use and not use others. The only way that looks possible is the one in the erlang ssl docs. However, the key-value as you see in my config provided above, is not recognized. So I still need some help there… hope this helps to clarify.
