Pre-info: webserver : Cowboy only, not using nginx My certs is from Let’s Encrypt (certbot) Debian 8 Generated dh-param.pem file using openssl 1/ SSL Tester: https://www.htbridge.com/ssl Right now, it can’t fulfill the “elliptic curves” criteria. “The server supports elliptic curves that a…

The warning messages are from Ranch, which is filtering out SSL options it does not recognize. Prior to version 1.3.0, Ranch only allowed whitelisted SSL options to be passed in. This was changed a few months ago to a blacklist: Blacklist listen options instead of whitelist · ninenines/ranch@b2b0996…

hey @Gazler , you’re listed as a Ranch package owner: could you push 1.3.x to Hex? If your child process isn’t flooding your mailbox, that is :stuck_out_tongue_winking_eye: (congrats!)

Thanks! @ericmj and I have pushed ranch 1.3 to hex now.

Thank you everybody, after spending some time testing and trying to fulfill every single one of the items in the ssl tests, I have Used the version of Ranch, 1.3.1, which was just pushed to Hex. That did the trick; the params (in the :atom format) are now recognized (did not put honor_ecc_order pa…

Thanks for sharing your experience, would love to read your article about this setup a-z :slight_smile:

[image] krapans: Thanks for sharing your experience, would love to read your article about this setup a-z :slight_smile: Yes this would be awesome to have!

Good, we’re getting closer, but we’re not there yet. The message regarding forward secrecy from SSLLabs suggests you have cipher suites enabled that do not use a DH exchange. The :ciphers parameter in your configuration file does list only DH-enabled suites, but unfortunately Erlang’s :ssl module i…

Hi everyone here, many thanks for your help, and for your interest! :slight_smile: So, now I am Proud Asian Dad, as it is possible to get A+ for BOTH ssllabs and htbridge’s ssl tests: This: [image] and this: [image] [image] krapans: Thanks for sharing your experience, would love to read …

Nice. great and compact tutorial for others. :smiley: Thanks again for sharing your experience! :slight_smile:

Most welcome, glad to help, also, before I forget, these params are necessary, and give the behaviour of: 1/ If you access asdf.qwer.com on your browser, the webserver will automatically redirect from port 80 to port 443. If you didn’t specify the http: [port: 80] param, then your server will n…