Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I installed Nginx and enabled SSL.

server {
  server_name vorb.de;
  listen      443;

  root        /var/www/vorb.de/pub;

  ssl         on;
  ssl_certificate     cert.pem;
  ssl_certificate_key cert.key;

  gzip        on;
  […]
}

Everything is working so far. The only thing that annoys me is that Chrome shows that the Server is using SSL 3.0 when you click on the lock/https icon. This version of SSL is deprecated (see https://vorb.de). When I visit an error page, everything is OK, since it shows TLS 1.0 being used (see https://vorb.de/non-existing-page). I am running Debian 6 Squeeze, Nginx 0.7.67 and OpenSSL 0.9.8o.

Do you know, why this happens?

share|improve this question
    
SSL 3.0 is not deprecated. –  David Schwartz Sep 23 '11 at 8:59
    
Yes, you're right. Bad word choice. –  pvorb Sep 23 '11 at 9:54
    
I just want to know: Is there an outdated package, which is causing this or is this due to my certificate or something else? –  pvorb Sep 23 '11 at 15:22
add comment

2 Answers

You can control the versions allowed by the server through the use of the ssl_ciphers directive.

Something along these lines should get your server allowing TLS connections only:

ssl_ciphers  HIGH:!SSLv2:!SSLv3;

As to why your browser negotiated different protocols on two different connections, I couldn't tell you.

share|improve this answer
    
When I try to do this, i get the following error: Restarting nginx: [emerg]: SSL_CTX_set_cipher_list("HIGH:!SSLv2:!SSLv3") failed (SSL: error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match) nginx. –  pvorb Sep 23 '11 at 17:11
add comment
up vote 0 down vote accepted

I completely reinstalled my system and am using Nginx 1.0.6 now. This worked, but is very time consuming.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.