io.js Default Ciphers Test

gistfile1.js

var constants = require('constants');
var fs = require('fs');
var https = require('https');

// Fedor's explicit cipher list.
// Good to see AES256 at the top of the list.
// Perhaps all the ECDHE ciphers should be moved above the DHE ciphers?
// Is the DES-CBC3-SHA necessary?
// Does not get A+ on ssllabs.
// Missing forward secrecy for IE and Safari reference browsers.
// These need CBC with ECDHE (is CBC with ECDHE vulnerable to Beast?)
var ciphersExplicit = [
  'ECDHE-ECDSA-AES256-GCM-SHA384',
  'ECDHE-RSA-AES256-GCM-SHA384',
  'ECDHE-ECDSA-AES256-GCM-SHA256',
  'ECDHE-RSA-AES256-GCM-SHA256',
  'ECDHE-ECDSA-AES256-SHA256',
  'ECDHE-RSA-AES256-SHA256',
  'DHE-RSA-AES256-GCM-SHA384',
  'DHE-RSA-AES256-GCM-SHA256',
  'DHE-RSA-AES256-SHA256',
  'AES256-GCM-SHA384',
  'AES256-SHA256',
  'ECDHE-ECDSA-AES128-GCM-SHA256',
  'ECDHE-RSA-AES128-GCM-SHA256',
  'ECDHE-ECDSA-AES128-SHA256',
  'ECDHE-RSA-AES128-SHA256',
  'ECDHE-ECDSA-AES128-SHA',
  'ECDHE-RSA-AES128-SHA',
  'DHE-RSA-AES128-GCM-SHA256',
  'DHE-RSA-AES128-SHA256',
  'DHE-RSA-AES128-SHA',
  'AES128-GCM-SHA256',
  'AES128-SHA256',
  'AES128-SHA',
  'DES-CBC3-SHA'
].join(':');

// DH Parameters are not actually necessary to get an A+ on ssllabs if we get the explicit ciphers list right.
// That is, all the reference browsers for forward secrecy support ECDHE.
var dhparam = [
  '-----BEGIN DH PARAMETERS-----',
  'MIGHAoGBAKZzu1Lw9OdlyO19/d1YnR/Xa6NCEZoWfp5aoWkGRuLafIL82nNccBzC',
  '+xIRT8I+Ub1q8cbNqCa45HzTamMrn6Vgq8xcGAMaQ+u/aM7/g1ceh2Bo4xJhUDd5',
  'Y2ma4p88C4xJaf+KQ1vAKc45zsR+Zwn51ZE8Xti2bDoq4bq4EQVTAgEC',
  '-----END DH PARAMETERS-----'
].join('\n');

var options = {};
options.key = fs.readFileSync('key');
options.cert = fs.readFileSync('cert');
options.ciphers = ciphersExplicit;
options.dhparam = dhparam;
options.honorCipherOrder = true;
// options.secureProtocol = 'SSLv23_method';
// options.secureOptions = constants.SSL_OP_NO_SSLv3;

var server = https.createServer(options,
  function(request, response) {
    response.setHeader('Strict-Transport-Security', 'max-age=31536000');
    response.end('200 OK');
  }
);
var tlsSessionStore = {};
server.on('newSession',
  function(sessionId, sessionData, end) {
    var id = sessionId.toString('hex');
    tlsSessionStore[id] = sessionData;
    end();
  }
);
server.on('resumeSession',
  function(sessionId, end) {
    var id = sessionId.toString('hex');
    var sessionData = tlsSessionStore[id];
    end(undefined, sessionData);
  }
);
server.listen(443);
console.log('Listening...');