Since few weeks, my webserver, Niginx, had a problem with TLS protocols version 1.1 & 1.2 :

  • When an user try to connect to my website, web browser and Nginx chose only TLS 1.0 for the conection.

  • in Nginx virtual host conf file, I mentionned to use TLS 1.0, 1.1 and 1.2 :

ssl_protocols             TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers               AES256-SHA256:AES256-SHA;
ssl_prefer_server_ciphers on;
  • Packages versions (newest for both) :

nginx version: nginx/1.4.2 TLS SNI support enabled configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-http_ssl_module --with-http_realip_module --with-http_addition_module --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_stub_status_module --with-mail --with-mail_ssl_module --with-file-aio --with-cc-opt='-g -O2 -Wp,-D_FORTIFY_SOURCE=2' --with-ld-opt= --with-ipv6

OpenSSL 1.0.1e 11 Feb 2013

  • Linux distrib : Debian 7.1 x64

  • Qualys ssl labs result

TLS 1.2 No

TLS 1.1 No

TLS 1.0 Yes

SSL 3 No

SSL 2 No

  • I tried to reboot, update, noting. I checked nginx conf file for each virtual host : all have the same parameters for ssl_protocols.

What is my mistake ?




5 Answers 5


Without messing up the installed openssl version that comes with your system, you can try to build nginx with a custom openssl version. Specify the following option when building your nginx package. I do this with my custom rpm and the latest openssl version.


Once build like this, install only the nginx package on your server and try the ssllabs test again. It should now show support for more versions.

  • I did this, but the protocol is still 1.0 :(
    – oddtwelve
    Aug 12, 2014 at 9:17

sorry for my bad English. I have the same situation and it took me much time to find out.The first ssl_protocol keywords which nginx read dominates all the server's ssl protocol in nginx conf.

Change the "ssl_protocol" value of all your server config (in fact just the first one is ok) to contains the value "TLSv1.2" may work.

openssl 1.0.1e is ok. But your os may have two versions of libssl.(mine has 0.9.8 and 1.0.1e). So your nginx maybe link to the libssl 0.9.8.

Try compile nginx with the specified newest version openssl source code.


I think you have to use

ssl_protocols             TLSv1.2 TLSv1.1 TLSv1;


ssl_protocols             TLSv1 TLSv1.1 TLSv1.2;

Here is what I normally use for SSL configuration with nginx:

ssl on;
ssl_certificate /etc/nginx/ssl/<domain>/server.crt;
ssl_certificate_key /etc/nginx/ssl/<domain>/server.key;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;

ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;

add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";

It's working config for prod servers, try:

ssl_session_timeout  10m;
ssl_ciphers      RC4:HIGH:!aNULL:!MD5:!kEDH;
ssl_session_cache shared:SSL:10m;
ssl_prefer_server_ciphers on;

And rerun Qualys ssl then.

  • After editing files - Qualys results : TLS 1.2 No TLS 1.1 No TLS 1.0 Yes SSL 3 Yes SSL 2 No
    – Hafl
    Sep 7, 2013 at 21:57
  • This doesn't enable TLS 1.2 or any of the newer ciphers. And it uses RC4 so it's not recommended. Sep 7, 2013 at 21:57
  • Yes, exact, I knew it but for resolve my issue, I can reduce security and then increase it. TLS &.1 can be enabled with this suite ?
    – Hafl
    Sep 7, 2013 at 21:58
  • I see. TLSv1.1/1.2 will work if you upgrade openssl package in the system.
    – astlock
    Sep 8, 2013 at 10:16
  • yes, but I had already lastest version: OpenSSL 1.0.1e 11 Feb 2013. Need reinstall - is safe about SSH access ?
    – Hafl
    Sep 8, 2013 at 18:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .