Repository: certbot/certbot

Issue:
Update SSL session cache size to match Mozilla recommendations
This is a followup from the research issue at #6903.

Ideally, https://github.com/mozilla/server-side-tls/issues/198 is resolved and Mozilla updates their recommendations. If not, I think we should update our value in https://github.com/certbot/certbot/blob/master/certbot-nginx/certbot_nginx/options-ssl-nginx.conf.

Exactly what these values should be is up for discussion, however, nginx's default timeout of 5 minutes seems like a reasonable place to start to me. I don't know of the top of my head how I think the cache should be configured.


Discussion:
For what it's worth, I looked into why our current cache size deviates from Mozilla's recommendations. Our current value comes from the initial PR that added the Nginx plugin which was https://github.com/certbot/certbot/pull/351. Mozilla has had its current recommendation from before that though: https://github.com/mozilla/server-side-tls/commit/b201a1191ba38e6f933cd02a4f425f683ffa9be4#diff-368131f28b06d0d830e9140e471682f9R43

I can't find any explanation to why we chose this value, however, we used to use [Ivan Ristić's Bulletproof SSL and TLS for ciphersuite recommendations in the nginx plugin](https://github.com/certbot/certbot/pull/351/files#diff-e1efd816f9338b4bd93f7f0ff456c7bdR7) and that book recommends our current `ssl_session_*` values so I think that's a safe bet.
Ivan [commented](https://github.com/mozilla/server-side-tls/issues/198#issuecomment-327402827) on that thread up there:
> These days I'd probably reduce the maximum session duration to 4 hours, down from 24 hours currently in my book. But that's largely based on a gut feeling that 4 hours is enough for you to reap the performance benefits, and using a shorter lifetime is always better. But, as I said, the only correct approach is to understand your exposure, measure and tune.
To update this issue with my understanding of the current state, @sydneyli talked to jsha about this who suggested we keep the 24 hour value which is fine with me.

Do we want to update the cache size to 50MB to match Mozilla? Unless we have a reason not to, I think we should just to not unnecessarily deviate from their recommendations and then I think we can close this PR.

What do you think @sydneyli?

Resolving patch:
diff --git a/certbot-nginx/certbot_nginx/constants.py b/certbot-nginx/certbot_nginx/constants.py
--- a/certbot-nginx/certbot_nginx/constants.py
+++ b/certbot-nginx/certbot_nginx/constants.py
@@ -24,6 +24,7 @@
 
 SSL_OPTIONS_HASHES_NEW = [
     '63e2bddebb174a05c9d8a7cf2adf72f7af04349ba59a1a925fe447f73b2f1abf',
+    '2901debc7ecbc10917edd9084c05464c9c5930b463677571eaf8c94bffd11ae2',
 ]
 """SHA256 hashes of the contents of versions of MOD_SSL_CONF_SRC for nginx >= 1.5.9"""
 
@@ -34,6 +35,7 @@
     '7f95624dd95cf5afc708b9f967ee83a24b8025dc7c8d9df2b556bbc64256b3ff',
     '394732f2bbe3e5e637c3fb5c6e980a1f1b90b01e2e8d6b7cff41dde16e2a756d',
     '4b16fec2bcbcd8a2f3296d886f17f9953ffdcc0af54582452ca1e52f5f776f16',
+    'c052ffff0ad683f43bffe105f7c606b339536163490930e2632a335c8d191cc4',
 ] + SSL_OPTIONS_HASHES_NEW
 """SHA256 hashes of the contents of all versions of MOD_SSL_CONF_SRC"""
 


Test patch: