Make the most of what macOS Server has to offer for HTTPS sites, including TLS 1.2, OCSP stapling, and cipher suite tuning.
With the Server 5.1 update providing TLS 1.2 support at last, courtesy of LibreSSL 2.2.6, it’s easy to score A+ on the Qualys SSL Server Test. Here’s a quick run-through of how to get the best performance from the new version.
As of version 5, the Server app still only supports TLS version 1.0 and a handful of suitable ciphers, but even within those constraints, we can improve the situation significantly by shutting off RC4 support and setting a preferred cipher order.
Unless you’re still using a version of the Server app released in 2013 or before, setting up OCSP stapling on OS X is very straightforward. Here’s how to boost performance by configuring OCSP stapling, plus an extra note to clear up some confusion about HSTS.
With version 5 of the Server app for OS X, Apache has problems correctly delivering TLS-enabled sites that use aliases, for example wrongly sending the ‘www’ variant of a site to the server’s default site. Here’s how to fix it.
As I described in the previous article in this series, one easy and straightforward approach to handling the transition from SHA-1 to SHA-2 certificates is to install a SHA-1 certificate as the main server certificate and individual SHA-2 certificates for each additional domain hosted on the server.
In this second article of a series on the new HTTPS landscape, I’ll describe one way of supporting both SHA-1 and SHA-2 with OS X Server.
Whoops, Google has decided your site will be at a disadvantage without HTTPS support. Whoops, Google has decided you’ll need to replace that shiny new server certificate you just bought. This is the first in a series of three articles exploring how to adapt.
This site is provided for informational and entertainment purposes only. It is not intended to provide advice of any kind.