Anne van Kesteren

TLS: issues with DreamHost

Update: since writing this DreamHost has upped their game. annevankesteren.nl gets an A+ on SSL Server Test. The first four bullet points below no longer apply.

There are numerous issues with TLS on DreamHost in a shared hosting setup unfortunately.

• Does not support TLS 1.2.
• Does not support forward secrecy.
• Has SSL 3.0 enabled (even when no unique IP is acquired for the domain and SNI is required, which SSL 3.0 does not support).
• Uses RC4 which has known weaknesses and fails on initial attempt in Internet Explorer 11.
• Provides no convenient way to add certificates. When a certificate is valid for a domain and its subdomains (e.g. both html5.org and *.html5.org), you have to configure it for each of them separately. For html5.org I have twelve domain entries in my control panel. Having to copy and paste the key, certificate, and intermediate certificate, as well as clicking through several screens for each of those entries, is very time consuming. The situation for whatwg.org is even worse.
• Has no built-in support for HSTS and therefore requires configuration for each domain.

To be honest, if I did not have this legacy and started looking for a solution today for twenty-thirty domains and as many subdomains, I would likely not pick DreamHost and try to figure out setting up something myself on a VPS. DreamHost is great value, but it does not offer perfection and that is irking.

Reportedly DreamHost will be improving this as they switch their server OS. Once they do I will update this post.