Example TLS / SSL potentially insecure

[Grant Murphy]

Originally posted on oss-security here: http://www.openwall.com/lists/oss-security/2015/02/04/7

> *) mod_ssl: New directive SSLSessionTickets (On|Off).
> The directive controls the use of TLS session tickets (RFC 5077),
> default value is "On" (unchanged behavior).
> Session ticket creation uses a random key created during web
> server startup and recreated during restarts. No other key
> recreation mechanism is available currently. Therefore using
> session
> tickets without restarting the web server with an appropriate
> frequency
> (e.g. daily) compromises perfect forward secrecy. [Rainer Jung]
>
>
> So if you use Apache 2.4 and care about PFS protecting your data, you
> should turn this feature off. This appears to be an implementation issue
> because there is no other way for Apache to recreate keys. I don't know
> a lot about the fine details of Session Tickets, but can anyone care to
> comment if there are other known bad implementations of session tickets
> out there? Does this affect Apache 2.2? Nginx? Lighttpd?

This may be pedantic but it might also be worth ensuring we are providing secure defaults in our example configurations for TLS termination / proxies here - http://docs.openstack.org/security-guide/content/tls-proxies-and-http-services.html

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/157146

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/157146
Committed: https://git.openstack.org/cgit/openstack/security-doc/commit/?id=71010c17c0790c41872a27a9b0b8fb70fc4e5983
Submitter: Jenkins
Branch: master

commit 71010c17c0790c41872a27a9b0b8fb70fc4e5983
Author: Bryan D. Payne <email address hidden>
Date: Wed Feb 18 12:29:29 2015 -0800

    Update TLS config recommendations

    Session tickets are tricky business. Using them correctly requires some
    additional thinking and tooling. This updates our suggested configs
    for Apache and Nginx to disable session tickets. And this also provides
    a mention of the issue for people to be aware of the situation.

    Change-Id: I70fe086a97d5c2db74c85b1b0fe16bf65b0339c4
    Closes-Bug: 1418661