Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I evaluated the SSL credentials of my server with qualsys ssl page ( ) and found the entry "SSL 2.0+ upgrade support" being marked as yes. I want to disable this sslv2 handshake too. I searched around and found,104032m, which points to creating a openssl.cnf file.

Have a naive question here. After creating the file, does one need to re-key his certificate for this to work ? Are there any other steps to follow ?

I use nginx 1.0.11 and openssl "OpenSSL 1.0.0e-fips 6 Sep 2011". I have set ssl_ciphers in nginx to SSLv3 TLSv1;

share|improve this question

Your certificate will work. openssl.cnf usually already exist in the system, so you need to edit one. Its location depends on which distribution/server version you are using. For example, if you are using Linux/Debian, it is located in /etc/ssl. But if you compiled OpenSSL it from the sources, the location would be of --sysconfdir used in configure (usually, --prefix + /etc). Make changes to the file as suggested on forum and restart nginx.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.