I want to ask your help to change my apache ssl config to nginx style. Actually i have tried it a googled but
SSLEngine on
SSLCertificateKeyFile /etc/apache2/ssl/key/netlime_tk.key
SSLCertificateFile /etc/apache2/ssl/crt/www_netlime_tk.crt
SSLCertificateChainFile /etc/apache2/ssl/crt/www_netlime_tk.cer
SSLCACertificateFile /etc/apache2/ssl/crt/www_netlime_tk.cer
SSLProtocol all -SSLv2 -SSLv3
SSLCipherSuite HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4:!SSLv2:!SSLv3
Actually i have done this but in ssl_protools are missing the exclude of versions, also everytime i have done "connected" chain with certificates, the ssl testing websites reported that these are wrong so i dont really want to join certificates together.
ssl_protocols TLSv1 TLSv1.1;
ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4:!SSLv2:!SSLv3;
ssl_certificate /etc/nginx/ssl/crt/www_netlime_tk.crt;
ssl_certificate_key /etc/nginx/ssl/key/netlime_tk.key;
#ssl_certificate_chain /etc/nginx/ssl/crt/www_netlime_tk.cer;
#ssl_ca_certificate /etc/nginx/ssl/crt/www_netlime_tk.cer;
Thank you :-* if you can give some technical explanation witch will teach me something then please do it.
Edit
Thank for all for help and time the final config for "Grade A" on ssllabs is
# SSL Configuration
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_certificate /etc/nginx/ssl/crt/www_netlime_tk.crt.bundle;
ssl_certificate_key /etc/nginx/ssl/key/netlime_tk.key;
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384.....very long string'
ssl_prefer_server_ciphers on;
ssl_dhparam /root/dhparams.pem;
ssl_cetificate
line. So acat www_netlime_tk.crt www_netlime_tk.cer > www_netlime_tk.crt.bundle
and use the .bundle file as thessl_certificate
setting. There's a good explanation and guide here: [digicert.com/ssl-certificate-installation-nginx.htm]-SSLv2
and -SSLv3
remove SSL version 2 & 3 so that mean it allow TLS like your nginx configuration already doesssl_protocols TLSv1 TLSv1.1;
.Anyway you can test your SSL level here : ssllabs.com/ssltest/analyze.html