Test io.js TLS ciphers

cipher-server.js

var constants = require('constants');
var fs = require('fs');
var https = require('https');

// Modified form of current io.js default ciphers which gets A+ on ssllabs (assuming SHA256 certificate signature).
// Downside is it's not explicit which would be much better.
var ciphersImplicit = [
  'ECDHE-RSA-AES128-GCM-SHA256',
  'ECDHE-RSA-AES128-SHA256',
  'ECDHE-RSA-AES128-SHA',
  'DHE-RSA-AES128-GCM-SHA256',
  'DHE-RSA-AES128-SHA256',
  'DHE-RSA-AES128-SHA',
  'AES128-GCM-SHA256',
  'HIGH',
  '!RC4',
  '!MD5',
  '!aNULL'
].join(':');

// Fedor's explicit cipher list.
// Good to see AES256 at the top of the list.
// Perhaps all the ECDHE ciphers should be moved above the DHE ciphers?
// Is the DES-CBC3-SHA necessary?
// Does not get A+ on ssllabs.
// Missing forward secrecy for IE and Safari reference browsers.
// These need CBC with ECDHE (is CBC with ECDHE vulnerable to Beast?)
var ciphersExplicit = [
  'ECDHE-ECDSA-AES256-GCM-SHA384',
  'ECDHE-RSA-AES256-GCM-SHA384',
  'ECDHE-ECDSA-AES256-GCM-SHA256',
  'ECDHE-RSA-AES256-GCM-SHA256',
  'ECDHE-ECDSA-AES256-SHA256',
  'ECDHE-RSA-AES256-SHA256',
  'DHE-RSA-AES256-GCM-SHA384',
  'DHE-RSA-AES256-GCM-SHA256',
  'DHE-RSA-AES256-SHA256',
  'AES256-GCM-SHA384',
  'AES256-SHA256',
  'ECDHE-ECDSA-AES128-GCM-SHA256',
  'ECDHE-RSA-AES128-GCM-SHA256',
  'ECDHE-ECDSA-AES128-SHA256',
  'ECDHE-RSA-AES128-SHA256',
  'ECDHE-ECDSA-AES128-SHA',
  'ECDHE-RSA-AES128-SHA',
  'DHE-RSA-AES128-GCM-SHA256',
  'DHE-RSA-AES128-SHA256',
  'DHE-RSA-AES128-SHA',
  'AES128-GCM-SHA256',
  'AES128-SHA256',
  'AES128-SHA',
  'DES-CBC3-SHA'
].join(':');

// DH Parameters are not actually necessary to get an A+ on ssllabs with the implicit ciphers.
// They're included here just for making sure we're not impacting the explicit ciphers.
// Perhaps it might be good to remove DHE from the default ciphers list since support for ECDHE is pretty good?
var dhparam = [
  '-----BEGIN DH PARAMETERS-----',
  'MIGHAoGBAKZzu1Lw9OdlyO19/d1YnR/Xa6NCEZoWfp5aoWkGRuLafIL82nNccBzC',
  '+xIRT8I+Ub1q8cbNqCa45HzTamMrn6Vgq8xcGAMaQ+u/aM7/g1ceh2Bo4xJhUDd5',
  'Y2ma4p88C4xJaf+KQ1vAKc45zsR+Zwn51ZE8Xti2bDoq4bq4EQVTAgEC',
  '-----END DH PARAMETERS-----'
].join('\n');

var options = {};
options.key = fs.readFileSync('key');
options.cert = fs.readFileSync('cert');
options.ciphers = ciphersExplicit;
options.dhparam = dhparam;
options.honorCipherOrder = true;
// options.secureProtocol = 'SSLv23_method';
// options.secureOptions = constants.SSL_OP_NO_SSLv3;

var server = https.createServer(options,
  function(request, response) {
    response.setHeader('Strict-Transport-Security', 'max-age=31536000');
    response.end('200 OK');
  }
);
var tlsSessionStore = {};
server.on('newSession',
  function(sessionId, sessionData, end) {
    var id = sessionId.toString('hex');
    tlsSessionStore[id] = sessionData;
    end();
  }
);
server.on('resumeSession',
  function(sessionId, end) {
    var id = sessionId.toString('hex');
    var sessionData = tlsSessionStore[id];
    end(undefined, sessionData);
  }
);
server.listen(443);
console.log('Listening...');