SSL server test (ssllabs)

ssllabs does a deep analysis of the site’s SSL configuration using SSL Labs’ SSL Server Test.

Why is this important?

SSL/TLS is a deceptively simple technology. It is easy to deploy, and it works–except when it does not. The main problem is that encryption is not often easy to deploy correctly. To ensure that TLS provides the necessary security, system administrators and developers must put extra effort into properly configuring their servers and developing their applications.

From SSL Labs’ SSL and TLS Deployment Best Practices

What does the hint check?

This hint uses the SSL Labs API via node-ssllabs to analyze the SSL configuration of a server and report a grade.

Please look at SSL Labs’ Methodology Overview if you want to know more about the process.

Notes:

• Only servers on the public internet can be scanned by SSL Labs. Internal domains will fail.
• SSL Labs might have decided not to allow scanning of a domain (if, for example, the owner has requested it).

Can the hint be configured?

By default, the minimum grade is A- but you can configure it to any valid grade reported by SSL Labs by setting the grade option for the ssllabs hint in the .hintrc file.

E.g. The following configuration will change the minimum grade to A+:

{
    "connector": {...},
    "formatters": [...],
    "hints": {
        "ssllabs": [ "error", {
            "grade": "A+"
        }],
        ...
    },
    ...
}

SSL Labs’ scanner also allows some configuration. By default, the one used is:

{
    "all": "done",
    "fromCache": true,
    "maxAge": 2
}

You can override the defaults with the following configuration:

{
    "connector": {...},
    "formatters": [...],
    "hints": {
        "ssllabs": [ "error", {
            "ssllabs": {
                "fromCache": false,
                ...
            }
        }],
        ...
    },
    ...
}

The list of possible parameters is available in SSL Labs’ documentation with the difference that on/off parameters are booleans in our case as shown in node-ssllabs’ advanced usage.

How to use this hint?

This package is installed automatically by webhint:

npm install hint --save-dev

To use it, activate it via the .hintrc configuration file:

{
    "connector": {...},
    "formatters": [...],
    "hints": {
        "ssllabs": "error",
        ...
    },
    "parsers": [...],
    ...
}

Note: The recommended way of running webhint is as a devDependency of your project.

Further Reading

• SSL and TLS Deployment Best Practices
• SSL Pulse
• SSL Labs Research wiki