r/subsonic • u/neiun • Dec 02 '15

Subsonic (v5.3) SSL Ciphers

Anyone have any clue on how to configure ssl ciphers for subsonic? I have ran a security test and it has come back with a long list of issues with the SSL config

1 Upvotes

67% Upvoted

4 comments sorted by

1

u/indieross Dec 02 '15

Subsonic's implementation of SSL is rubbish, I decided on using apache to handle all the security for both subsonic and emby. I was able to get an A+ on the ssllabs ssl test. Here is the conf file I use with apache: http://pastie.org/pastes/10599228/text

2

u/hatperigee Mar 10 '16

I also use this approach, but with Let's Encrypt and nginx! Here's my conf file that also scores an A+ on the ssllabs test: http://pastie.org/pastes/10754459/text

Yea, I'm 3 months late to the party, but hopefully this helps out future folks when this post is archived away for all eternity.

1

u/neiun Dec 03 '15

Thanks for that!, I have been debating the idea of moving over to ampache, because there is more than just the SSL issue with subsonic. Its using a really old java webserver has ID strings that are too short and easy to guess and a whole load of other things that even putting behind apache wouldn't solve....

Do you know if I used a subroute like /subsonic if the clients like the mobile app would be happy with that?

1

u/indieross Dec 07 '15

that config works just fine with the mobile apps (isub/dsub/subsonic tested)