SSL config

[aaronsnow]

Per @konklone, SSL Labs has a few security suggestions.

[GUI]

Thank for brining this up, Eric and Aaron. For api.data.gov, we currently use AWS ELBs to handle our public-facing HTTPS connections. I swapped the security policy to Amazon's more recently recommended ELBSecurity Policy-2014-01 and we now score an A. There are still a few warnings, but most of Amazon's new configuration seems like a good balance of security with compatibility. Let me know if you have any further suggestions for SSL tweaks, though.

[konklone]

That's amazing turnaround, thank you, @GUI!