3

Since few weeks, my webserver, Niginx, had a problem with TLS protocols version 1.1 & 1.2 :

  • When an user try to connect to my website, web browser and Nginx chose only TLS 1.0 for the conection.

  • in Nginx virtual host conf file, I mentionned to use TLS 1.0, 1.1 and 1.2 :

ssl_protocols             TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers               AES256-SHA256:AES256-SHA;
ssl_prefer_server_ciphers on;
  • Packages versions (newest for both) :

nginx version: nginx/1.4.2 TLS SNI support enabled configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-http_ssl_module --with-http_realip_module --with-http_addition_module --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_stub_status_module --with-mail --with-mail_ssl_module --with-file-aio --with-cc-opt='-g -O2 -Wp,-D_FORTIFY_SOURCE=2' --with-ld-opt= --with-ipv6

OpenSSL 1.0.1e 11 Feb 2013

  • Linux distrib : Debian 7.1 x64

  • Qualys ssl labs result

TLS 1.2 No

TLS 1.1 No

TLS 1.0 Yes

SSL 3 No

SSL 2 No

  • I tried to reboot, update, noting. I checked nginx conf file for each virtual host : all have the same parameters for ssl_protocols.

What is my mistake ?

Thanks

haflinger

2

Without messing up the installed openssl version that comes with your system, you can try to build nginx with a custom openssl version. Specify the following option when building your nginx package. I do this with my custom rpm and the latest openssl version.

--with-openssl=/home/mschirrmeister/openssl-1.0.1f

Once build like this, install only the nginx package on your server and try the ssllabs test again. It should now show support for more versions.

  • I did this, but the protocol is still 1.0 :( – oddtwelve Aug 12 '14 at 9:17
1

sorry for my bad English. I have the same situation and it took me much time to find out.The first ssl_protocol keywords which nginx read dominates all the server's ssl protocol in nginx conf.

Change the "ssl_protocol" value of all your server config (in fact just the first one is ok) to contains the value "TLSv1.2" may work.

openssl 1.0.1e is ok. But your os may have two versions of libssl.(mine has 0.9.8 and 1.0.1e). So your nginx maybe link to the libssl 0.9.8.

Try compile nginx with the specified newest version openssl source code.

0

I think you have to use

ssl_protocols             TLSv1.2 TLSv1.1 TLSv1;

not

ssl_protocols             TLSv1 TLSv1.1 TLSv1.2;
0

Here is what I normally use for SSL configuration with nginx:

ssl on;
ssl_certificate /etc/nginx/ssl/<domain>/server.crt;
ssl_certificate_key /etc/nginx/ssl/<domain>/server.key;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4";

ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;

add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
-1

It's working config for prod servers, try:

ssl_session_timeout  10m;
ssl_ciphers      RC4:HIGH:!aNULL:!MD5:!kEDH;
ssl_session_cache shared:SSL:10m;
ssl_prefer_server_ciphers on;

And rerun Qualys ssl then.

  • After editing files - Qualys results : TLS 1.2 No TLS 1.1 No TLS 1.0 Yes SSL 3 Yes SSL 2 No – Hafl Sep 7 '13 at 21:57
  • This doesn't enable TLS 1.2 or any of the newer ciphers. And it uses RC4 so it's not recommended. – Michael Hampton Sep 7 '13 at 21:57
  • Yes, exact, I knew it but for resolve my issue, I can reduce security and then increase it. TLS &.1 can be enabled with this suite ? – Hafl Sep 7 '13 at 21:58
  • I see. TLSv1.1/1.2 will work if you upgrade openssl package in the system. – astlock Sep 8 '13 at 10:16
  • yes, but I had already lastest version: OpenSSL 1.0.1e 11 Feb 2013. Need reinstall - is safe about SSH access ? – Hafl Sep 8 '13 at 18:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.