Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When I'm browsing to my SSL protected site running nginx with Chrome, I see I'm using TLS 1.0, AES_256_CBC with SHA-1, and DHE_RSA as key exchange. That's all good and in conformance with my cipher suite settings.

However, I'm using DEFLATE compression too. Which is superfluous in my opinion, since all the needed content (mainly JSON files) is already gzip compressed. Is there any way I can turn off deflate compression for SSL usage in nginx?

share|improve this question
3  
What did you know a month ago? It looks like there may be a critical vulnerability in SSL compression. See here: security.stackexchange.com/questions/19911/… –  Nate Sep 11 '12 at 12:27
1  
@Nate nothing in special, I found it however interesting both nginx and OpenSSL disabled SSL compression. –  hvtilborg Sep 12 '12 at 6:55

1 Answer 1

up vote 6 down vote accepted

SSL compression is turned off by default in nginx 1.1.6+/1.0.9+ (if OpenSSL 1.0.0+ used) and nginx 1.3.2+/1.2.2+ (if older versions of OpenSSL are used). If you see SSL compression, you probably want to upgrade nginx.

Another obvious solution is to recompile OpenSSL without zlib compression support (which is actually the default).

share|improve this answer
    
I'm using nginx/1.2.1 (from Debian squeeze backports) and OpenSSL 0.9.8o (standard in Debian squeeze). This means I can't turn off DEFLATE when I'm not willing to compile from source? –  hvtilborg Aug 15 '12 at 7:07
1  
You may install newer binary package e.g. from nginx.org. –  Maxim Dounin Aug 15 '12 at 16:20
    
I still see compression with nginx 1.2.2 and openssl 0.9.8k. I ended up rebuilding the openssl package with compression disabled. –  alberge Sep 13 '12 at 20:39
    
@alberge If you used precompiled nginx binary, this is possible if it was compiled with OpenSSL 1.0.0+. In this case workaround to disable compression in older OpenSSL versions isn't used and nginx instead will set an option to disable compression (but the option isn't understood by your OpenSSL 0.9.8k, hence you see compression). –  Maxim Dounin Sep 17 '12 at 9:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.