up vote 0 down vote favorite
share [g+] share [fb]

I installed Nginx and enabled SSL.

server {
  server_name vorb.de;
  listen      443;

  root        /var/www/vorb.de/pub;

  ssl         on;
  ssl_certificate     cert.pem;
  ssl_certificate_key cert.key;

  gzip        on;
  […]
}

Everything is working so far. The only thing that annoys me is that Chrome shows that the Server is using SSL 3.0 when you click on the lock/https icon. This version of SSL is deprecated (see https://vorb.de). When I visit an error page, everything is OK, since it shows TLS 1.0 being used (see https://vorb.de/non-existing-page). I am running Debian 6 Squeeze, Nginx 0.7.67 and OpenSSL 0.9.8o.

Do you know, why this happens?

link|improve this question
67% accept rate
SSL 3.0 is not deprecated. – David Schwartz Sep 23 '11 at 8:59
Yes, you're right. Bad word choice. – pvorb Sep 23 '11 at 9:54
I just want to know: Is there an outdated package, which is causing this or is this due to my certificate or something else? – pvorb Sep 23 '11 at 15:22
feedback

2 Answers

up vote 0 down vote

You can control the versions allowed by the server through the use of the ssl_ciphers directive.

Something along these lines should get your server allowing TLS connections only:

ssl_ciphers  HIGH:!SSLv2:!SSLv3;

As to why your browser negotiated different protocols on two different connections, I couldn't tell you.

link|improve this answer
When I try to do this, i get the following error: Restarting nginx: [emerg]: SSL_CTX_set_cipher_list("HIGH:!SSLv2:!SSLv3") failed (SSL: error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match) nginx. – pvorb Sep 23 '11 at 17:11
feedback
up vote 0 down vote accepted

I completely reinstalled my system and am using Nginx 1.0.6 now. This worked, but is very time consuming.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.