Letsencrypt update gives vulnerability errors and grade F

Help
1

Hello,

I have updated my Lets Encrypt SSL certificates and validated them on https://www.ssllabs.com. I have used Lets Encrypt for a while and made no changes to my setup other than requesting new certificate files and restarting apache to reflect that.

Now today I notice my grade went from a B to an F and the website noted that the certificate does not protect against these vulnerabilities:

OpenSSL 0-Length
OpenSSL Padding Oracle vuln. (CVE-2016-2107)
RC4

I remember a few months back that lets encrypt made updates to their certificates. I wonder if that could be part of the problem.

Does anyone know how to fix this problem?

My domain is: https://buy.ontariospeeddating.ca/

My web server is (include version): Apache 2

The operating system my web server runs on is (include version): CentOS 6

I can login to a root shell on my machine (yes or no, or I don't know): Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): whm/cpanel

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): custom

2

That version of the OS stopped receiving security updates four years ago. Disconnect this machine from the internet immediately and upgrade it. The upgrade may also fix the issues you're experiencing.

4 Likes
3

I agree with @Nekit here: your F rating is NOT due to the Let's Encrypt certificate at all, but due to the usage of vulnerable software. You should not have this server connected to the internet.

5 Likes
4

The current use has exposed the private key for that cert.
I would fix the cipher problem and delete that cert and replace it with a new one with a new key.

3 Likes
5

This is what I use to generate keys:

It created a few files in a buy.ontario-speeddating.ca_ecc (replaced with /path/to/ here for privacy reasons) folder which I put into my apache configuration as follows. And all files exist:

SSLEngine on
SSLProtocol all -SSLv2 -SSLv3
SSLCertificateFile /path/to/buy.ontariospeeddating.ca.cer
SSLCertificateKeyFile /path/to/buy.ontariospeeddating.ca.key
SSLCertificateChainFile /path/to/fullchain.cer

I had to add the 2nd line because there was talks about some vulnerability if SSLv3 was enabled.

Am I using the wrong files?

6

You are referencing a file that contains both the leaf and intermediate certificates in your SSLCertificateChainFile directive, so that is definitely wrong. That directive was deprecated long ago by Apache, but your OS is so old that I have no idea if your Apache is recent enough to support the current syntax.

You needed to get that OS off the internet four years ago, when security support ended. Your unmaintained operating system is the cause of your issues, not Let’s Encrypt. You can come back here if you are encountering difficulty with Let’s Encrypt on a current operating system, but we can't help you fix one that has been neglected for that many years.

3 Likes
7

[SOLVED]

A bit of research indicates I shouldn't be using CBC ciphers. After a search, I came across this link:

https://serverfault.com/questions/740259/how-to-prevent-cbc-ciphers-while-using-tls-1-0-in-apache

After changing my cipher suite from:

ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP:!kEDH

To:

ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256

and gracefully restarting apache, I ran the tests again and got an A with NO errors except for it claiming those on windows XP with chrome 49 not being able to connect.

I wonder how often one would have to reconfigure the cipher suite on their servers with how fast tech is changing...

8

Mozilla has good recommendations for setting your cipher suites:

But as others are saying, if your OS isn't getting security updates, even if you can make connections over TLS one shouldn't make the mistake of thinking that the data you're communicating is "secure" in any way.

4 Likes
9

You should still replace that cert and key.

2 Likes
10

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.