Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

i have this nginx.conf file

worker_processes  4;
worker_priority  15;
error_log  logs/error.log  notice;

pid        logs/nginx.pid;
events {
        use kqueue;              # event method, kqueue for FreeBSD and OpenBSD
        worker_connections 1024; # number of parallel or concurrent connections per worker_processes
}

http {
        proxy_cache_path  /var/cache/nginx levels=1:2 keys_zone=one:8m max_size=3000m inactive=600m;
        proxy_temp_path /var/tmp;

        # ECDSA ssl ciphers; google chrome prefered order, 128bit most prefered
        ssl_ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA;
        ssl_ecdh_curve secp384r1;      # 384 bit prime modulus curve efficiently supports ECDHE ssl_ciphers up to a SHA384 hash
        ssl_prefer_server_ciphers on;
        ssl_protocols sslv3 TLSv1.2 TLSv1.1 TLSv1;
        ssl_session_timeout 128s;
        ssl_stapling on;

        client_body_timeout      2s;    # maximum time between packets the client can pause when sending nginx any data
        client_header_timeout    2s;    # maximum time the client has to send the entire header to nginx
        keepalive_timeout       28s;    # timeout which a single keep-alive client connection will stay open
        send_timeout            10s;    # maximum time between packets nginx is allowed to pause when sending the client data
        spdy_keepalive_timeout 128s;    # inactivity timeout after which the SPDY connection is closed
        spdy_recv_timeout        2s;    # timeout if nginx is currently expecting data from the client but nothing arrives
        # general options for FreeBSD on ZFS
        aio                     on;     # asynchronous file input/output, fast with ZFS, make sure sendfile=off
        charset                 utf-8;  # adds the line "Content-Type" into response-header, same as "source_charset"
        default_type            application/octet-stream;
        disable_symlinks           on;  # disable symlinks to avoid malicious symlinks out of the document root
        etag                      off;  # disables "ETag" response header so clients use Cache-Control header only
        gzip                      off;  # disable on the fly gzip compression, only use gzip_static to reduce latency
        gzip_http_version         1.0;  # serve gzipped content to all clients including HTTP/1.0 and greater
        gzip_static            always;  # precompress content (gzip -9) with an external script found on this page below
        gzip_proxied              any;  # allows compressed responses for any request even from proxies
        gzip_min_length          1000;
        gzip_types              text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
        gzip_buffers            16 8k;
        ignore_invalid_headers     on;
        include                  mime.types;
        keepalive_requests         20;  # number of keep alive requests per connection, does not affect SPDY
        keepalive_disable        none;  # allow all browsers to use keepalive connections
        lingering_time              2;  # maximum time during which nginx will process additional data from the client
        lingering_timeout           2;  # maximum waiting time for more client data to arrive
        max_ranges                  1;  # allow a single range header for resumed downloads and to stop large range header DoS attacks
        merge_slashes              on;  # compression of two or more adjacent slashes in a URI into a single slash "//" into "/"
        msie_padding              off;
        output_buffers         1 256K;  # sendfile=off so set to the total size of all objects on an average page
        recursive_error_pages      on;
        reset_timedout_connection  on;  # reset timed out connections freeing ram and resources
        sendfile                  off;  # off for FreeBSD and ZFS to avoid redundant data caching
        server_tokens             off;  # no nginx version number in error pages
        source_charset          utf-8;  # same value as "charset"
        spdy_headers_comp           1;  # SPDY gzip header compression to at least one(1) (default 0)
        spdy_max_concurrent_streams 20; #SPDY maximum parallel client requests (default 100)
        tcp_nodelay                on;  # disable the Nagle buffering algorithm, used for keepalive only
        tcp_nopush                off;  # sendfile=off so tcp_nopush can not be used

        # request limits
        limit_req_zone $binary_remote_addr zone=gulag:1m rate=25r/m;

        # log format
        log_format  main  '$remote_addr $host $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $ssl_protocol $ssl_cipher $request_time';

        upstream domain_upstream {
                server 10.6.6.8:3000;
                keepalive 64;
        }

        server {
                listen       80;
                server_name  localhost;
                #access_log  logs/host.access.log  main;
                location / {
                        root   html;
                        index  index.html index.htm;
                }
                #error_page  404              /404.html;
                error_page   500 502 503 504  /50x.html;
                location = /50x.html {
                        root   html;
                }
        }

        server {
                add_header              Alternate-Protocol "443:npn-spdy/3.1";
                add_header              Cache-Control "max-age=315360000, public";
                add_header              X-Frame-Options "DENY";
                access_log              logs/access.log  main;
                error_log               logs/error.log info;
                limit_req               zone=gulag burst=50 nodelay;
                listen                  80;
                root                    /var/empty;
                server_name             dev.domain.com;
                return                  301 https://$server_name$uri;
        }
        server {
                add_header              Alternate-Protocol "443:npn-spdy/3.1";
                add_header              Cache-Control "max-age=315360000, public";
                add_header              Strict-Transport-Security "max-age=31536000; includeSubdomains";
                access_log              logs/access.log  main;
                error_log               logs/error.log info;
                limit_req               zone=gulag burst=50 nodelay;
                listen                  443 ssl;
                ssl_certificate         /etc/ssl/certs/domain.com.bundle.crt;
                ssl_certificate_key     /etc/ssl/certs/ccc_ssl.key;

                server_name             dev.domain.com;
                client_max_body_size    20M;
                location / {
                  proxy_redirect         off;
                  proxy_set_header       X-Real-IP               $remote_addr;
                  proxy_set_header       X-Forwarded-For         $proxy_add_x_forwarded_for;
                  proxy_set_header       X-Forwarded-Proto       $scheme;
                  proxy_set_header       Host                    $http_host;
                  proxy_set_header       X-NginX-Proxy           true;
                  proxy_set_header       Connection              "";
                  proxy_http_version     1.1;
                  proxy_cache            one;
                  proxy_cache_key        sfs$request_uri$scheme;
                  proxy_pass             http://domain_upstream;
                }
        }
}

we use an EV certificate bundle, all works well on Chrome and Firefox but on Opera, i get the following errors

2014/06/10 11:39:38 [info] 16260#0: *1 SSL_do_handshake() failed (SSL: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher) while SSL handshaking, client: 78.32.137.170, server: 0.0.0.0:443

Unable to complete secure transaction Show Details

Secure connection: fatal error (40) from server.

https://domain.com/

Failed to connect to server. The reason may be that the encryption methods supported by the server are not enabled in the security preferences.

Please note that some encryption methods are no longer supported, and that access will not be possible until the website has been upgraded to use strong encryption.

when i run:

openssl req -in domain_ssl.csr -text -noout

i get:

        Public Key Algorithm: id-ecPublicKey
            Public-Key: (384 bit)

Signature Algorithm: ecdsa-with-SHA256

any advise on how to deal with this is much appreciated.

share|improve this question
    
Why do you have such a small and specific set of allowed ciphers? –  Michael Hampton Jun 10 at 13:46
    
i changed it to gist.github.com/nkhine/f620f8bdc0fb613b7b59 but i still get the same issue. –  khinester Jun 10 at 14:16
    
The version of opera you're using may not support ecdsa. What version is it? Also, you way want to use ssllabs.com/ssltest to verify your SSL setup. –  Steve Wills Jun 12 at 18:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.