902602 - Improve HTTPS settings for Firefox Health Report (fhr.cdn.mozilla.net)

Status: UNCONFIRMED

(Cloud Services :: Firefox: Common, defect)

Description

[Dan Wolff]

User Agent: Mozilla/5.0 (X11; Linux i686; rv:24.0) Gecko/20130805 Firefox/24.0 (Nightly/Aurora)
Build ID: 20130805004006

Steps to reproduce:

Check out https://www.ssllabs.com/ssltest/analyze.html?d=fhr.cdn.mozilla.net

(the FHR is currently hosted at https://fhr.cdn.mozilla.net/en-US/)


Actual results:

The page lists two of problems:
* Forward secrecy not enabled
* The server does not mitigate the BEAST attack (not necessary since Firefox mitigates it)



Expected results:

Forward secrecy should be enabled and there is no reason not to mitigate the BEAST attack.

Comment 1

[Dan Wolff]

Since no user data is sent to the server, it doesn't really matter for the CDN, but the server which *does* receive the data should at least have forward secrecy enabled.

And even for the CDN, there's no reason not to have it.

Comment 2

[gorenje]

Same bug found here https://www.gorenje.ind.in