A couple of days ago, Wordpress.com announced that they are now supporting TLS for custom domains (which is how this blog is hosted). There are many reasons for not hosting a blog yourself even if you have the necessary skills, like not having to deal with security updates and scalability issues for starters. Flexibility isn't one of them, unfortunately, so I'm very pleased TLS has finally arrived. But let's have a look at their setup.

First things first, the unavoidable Qualys SSL Server Test:

Looks pretty good. No obvious security issues or misconfigurations. Very old browsers like IE 6 on Windows XP will not work due to lack of SNI, but I can certainly live with that. The only fix for that would be an individual IP address per blog, but nobody has that many IPv4 addresses available these days.

As mentioned in their announcement, they use short-lived certificates from Let's Encrypt that seem to be shared by ~50 sites each. Sharing is probably a good compromise - it reduces the number of certificates Let's Encrypt has to handle while still keeping the certificates small enough for transmission during the handshake.

Speaking of performance, session resumption is supported, both using IDs and tickets, so repeat visitors save a network roundtrip during TLS handshake. The fact that they also enabled HTTP/2 is another plus in that regard (but no IPv6, tsk).

Just a couple minor things could be improved. At the time of this writing, they don't have HTTP Strict Transport Security yet, which would help reduce the chance of man-in-the-middle attacks. This would have yielded an "A+" grade, but let's keep in mind that we're dealing with blogs here and not with ecommerce or financial sites.

Also, OSCP stapling would be a plus, but that's probably harder than it looks. I know from experience that managing huge numbers of certificates isn't an easy thing to do on servers like Nginx - they simply haven't been designed with that use case in mind.

Overall I'm very happy with the change. It's something that mostly us network and security geeks will truly appreciate, but given Wordpress' market share, it's very important for the web as a whole.