Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I installed Nginx and enabled SSL.

server {
  listen      443;

  root        /var/www/;

  ssl         on;
  ssl_certificate     cert.pem;
  ssl_certificate_key cert.key;

  gzip        on;

Everything is working so far. The only thing that annoys me is that Chrome shows that the Server is using SSL 3.0 when you click on the lock/https icon. This version of SSL is deprecated (see When I visit an error page, everything is OK, since it shows TLS 1.0 being used (see I am running Debian 6 Squeeze, Nginx 0.7.67 and OpenSSL 0.9.8o.

Do you know, why this happens?

share|improve this question
SSL 3.0 is not deprecated. – David Schwartz Sep 23 '11 at 8:59
Yes, you're right. Bad word choice. – pvorb Sep 23 '11 at 9:54
I just want to know: Is there an outdated package, which is causing this or is this due to my certificate or something else? – pvorb Sep 23 '11 at 15:22

You can control the versions allowed by the server through the use of the ssl_ciphers directive.

Something along these lines should get your server allowing TLS connections only:

ssl_ciphers  HIGH:!SSLv2:!SSLv3;

As to why your browser negotiated different protocols on two different connections, I couldn't tell you.

share|improve this answer
When I try to do this, i get the following error: Restarting nginx: [emerg]: SSL_CTX_set_cipher_list("HIGH:!SSLv2:!SSLv3") failed (SSL: error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match) nginx. – pvorb Sep 23 '11 at 17:11
up vote 0 down vote accepted

I completely reinstalled my system and am using Nginx 1.0.6 now. This worked, but is very time consuming.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.