0

For backwards compatibility with some of our partners, we have to run TLSv1 on some of our websites. The problem is after latest upgrades current settings no longer accept TLSv1 even though it's setup in the Vhost file.

I'm running Nginx 1.4.6 with OpenSSL 1.0.1f this is our setup file

server {
        listen  443 ssl;
        listen [::]:443 ssl;
        server_name www.example.com;
        root        /path/to/websites/www.example.com/public;
        index       /index.php;
        access_log      off;
        error_log      /path/to/logs/logs/error.log;

        rewrite ^/(.*)/$ /$1 break;

        ssl on;
        ssl_certificate /etc/nginx/ssl/ssl-bundle.crt;
        ssl_certificate_key /etc/nginx/ssl/myserver.key;


        ssl_session_timeout 5m;

        ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:DES-CBC3-SHA:HIGH:SEED:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!RSAPSK:!aDH:!aECDH:!EDH-DSS-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA:!SRP';
    ssl_prefer_server_ciphers on;

        ssl_dhparam /etc/nginx/ssl/dhparam.pem;

        ssl_stapling on;
        ssl_stapling_verify on;

        location / {
                try_files $uri $uri/ /index.php$is_args$args;
        }

        include php.conf;
}

Can't really understand what's going on, but bottom line we need TLSv1 TLSv1.1 and TLSv1.2 enabled. Can anyone help?

Thanks in advanced

4
  • You need to find a way to demonstrate the problem, something like this serverfault.com/questions/638691/… . I also wonder if the ciphers are a problem - I might try commenting it out to default as a test.
    – Tim
    Jan 20, 2017 at 18:16
  • I did try commenting out the ciphers however the result was the same. I also believe the ciphers are the issue but tried multiple combinations and none of it worked. I wonder is there is and online tool where we can input the browsers we want to use and get the ciphers we need to activate? Unlikely but would be nice. We have moved the domain in question to an apache box which I'm much more comfortable with and is now doing what we intend it to do but I'll keep digging for educational purpose. I don't have access to the box now but will dump de result of openssl s_client here as soon as I can. Jan 20, 2017 at 19:22
  • cipherli.st Jan 20, 2017 at 19:28
  • Hi Michael. Doesn't this website actually show strong ciphers? Will they be compatible with old browsers like IE8 under windows XP? Jan 20, 2017 at 19:37

0

You must log in to answer this question.

Browse other questions tagged .