SSL Test problem on SSL over VPN port 433 or am i missing something?

[xorg 0]

Hi,

I tested the SSL grade thanks to htbridge.com, unfortunately, I received a grade F on Alrai server (and many others) for the SSL over VPN, so am i missing something with the way stunnel works, or is it really dangerous?

 

For Menkab (Sweden): https://www.htbridge.com/ssl/?id=087337b0aad4a04ca5a4ed25d9468e7f67cd3df4ee86a7cdd4b7f4c700d92de6

 

FYI i'm using the portable expermiental client (because I had a lot of bugs with Debian Testing)

 

 

[serenacat 83]

Out of curiosity I loaded the url and checked AirVPN Antares as I use SSL:443 as a gesture to make it harder to block or track VPN use by the "Internet Police/Regulators/Dataharvesters".

So 103.254.153.100:443 gets an "F". Checking the detailed report, it complains about self-signed and weak certificate and presence of weaker cipher suites with client side renegotiation. Not a security expert, but some system/network admin experience. Seems like a small degree of weakness for attack by agency with big resources, but passes for strong security, "grade C" ?

It would be nicer to be fixed and get an "A", and then brag about it on the front webpage blurb. And would "cover your a***" in some commercial organisations if chosen AirVPN rather than outsourced "security" to this ImmuniWeb org at big cost.

And of course the probability of breaking SSL multiplied by the probability of breaking OpenVPN multiplied by the probability of you being Donald's accountant is a very small probability.

[zhang888 1066]

These tests are irrelevant if you test the VPN servers, SSL is only used as a method to bypass DPI, and not for an additional security. Even SSLv2 support is ok for that.

The only amount of encryption is needed there to make it look like real SSL for restrictive networks or traffic shaping appliances.

The data channel and control channel of the actual OpenVPN connection are still encrypted with TLS1.2 and AES-256-CBC with HMAC-SHA1 for authentication.

 

The real tests you should make are supposed to be on the actual https://airvpn.org website, which complies to all modern security standards, and will obviously

score A+ on various TLS testing services, such as Qualys SSLLabs: https://www.ssllabs.com/ssltest/analyze.html?d=airvpn.org&s=5.196.64.52&hideResults=on