3

I tried setup SSL cert without SSLv3 in my nginx, but SSL Labs say, my server have SSLv3 how to disable it.

My config:

    add_header Strict-Transport-Security max-age=31536000;
    add_header X-Frame-Options DENY;

    ssl_session_cache shared:SSL:10m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers "EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA256:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EDH+aRSA+AESGCM:EDH+aRSA+SHA256:EDH+aRSA:EECDH:!aNULL:!eNULL:!MEDIUM:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4:!SEED";
    ssl_prefer_server_ciphers on;
    add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains';
  • Have you restarted nginx after updating the configuration? If you've tested the same site with SSL labs do they cache the results of the test, so you're getting a false positive? – SamR. Oct 31 '14 at 7:59
  • Yes. I restarted nginx. I think i have wrong ciphers. – Rinat Mukhamedgaliev Oct 31 '14 at 8:13
6

Here is a good Tutorial how to configure nginx with the best settings.

https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html

Your configuration for SSLv3 is correct.

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

In the post is a section for your ciphers.

ssl_ciphers 'AES256+EECDH:AES256+EDH';
  • How to exclude all ciphers with 128 bit and all low quality as RC4? – Rinat Mukhamedgaliev Oct 31 '14 at 8:57
  • Read the post ;) the system takes only the ciphers your write into your config – René Höhle Oct 31 '14 at 9:17
  • very strange. I tried connect from console openssl s_client -connect my_site.com:443 -ssl3 and have response SSL-Session: Protocol : SSLv3 Cipher : ECDHE-RSA-RC4-SHA My suite "AES256+EECDH:AES256+EDH:!ECDHE-RSA-RC4-SHA:!EECDH+aRSA+RC4:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS" Where wrong? – Rinat Mukhamedgaliev Oct 31 '14 at 9:37
  • Have you changed all config files? Perhaps there is another file that is not correct. – René Höhle Oct 31 '14 at 9:38
  • grep -slir "ssl_ciphers" /etc/nginx/ – René Höhle Oct 31 '14 at 9:38
6

I had set my ssl_protocols correctly and could not get it to disable SSLv3, according to https://www.tinfoilsecurity.co... or ssllabs.com 's tests. Eventually I discovered

https://disablessl3.com/#test which mentions trying:

openssl s_client -connect <hostname:443> -ssl3

as the command to test it with. When I did that, I discovered that nginx was using another virtualhost's SSL cert for the initial handshake, rather than the one set up in this specific virtualhost. Once I added in the ssl_protocols line in all virtualhosts that use SSL, it suddenly started working.

  • Upvote because I had another config too that was causing the problem. – Danny Jun 3 '15 at 15:46
  • This is VERY important. I was pulling my hair out trying to figure out what was going on! – akohlsmith Dec 8 '15 at 4:41
2

Great i fix it! This is my config

ssl on;
ssl_ciphers 'AES256+EECDH:AES256+EDH::!EECDH+aRSA+RC4:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS';
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_session_cache shared:SSL:10m;

ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.4.4 8.8.8.8 valid=300s;
resolver_timeout 10s;

ssl_prefer_server_ciphers on;

add_header Strict-Transport-Security max-age=63072000;
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;

My grade: enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.