Solve in your browser

Edit the files below. The Objectives tick green live as you work. Hit Check when they all pass and your verified proof page is issued automatically.

Objectives

Not met: Only TLSv1.2 and/or TLSv1.3 are enabled; no SSLv3, TLSv1, or TLSv1.1
Not met: The cipher list contains no broken families (RC4, DES/3DES, MD5, NULL, EXPORT)
Not met: A Strict-Transport-Security header with a max-age is sent

# /etc/nginx/conf.d/app.conf, TLS frontend for app.example.com (unhardened)

server {
    listen 443 ssl;
    server_name app.example.com;

    ssl_certificate     /etc/ssl/certs/app.crt;
    ssl_certificate_key /etc/ssl/private/app.key;

    # Legacy protocols are still negotiable:
    ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;

    # The cipher list still offers broken families:
    ssl_ciphers RC4-SHA:DES-CBC3-SHA:AES128-SHA:AES256-SHA;


    location / {
        proxy_pass http://127.0.0.1:8080;
    }
}

Objectives update live as you edit. Hitting Check commits your proof.

No account needed to explore. When you're ready, browse the rest of the challenges or sign in to save a solve as a verified proof.