I tried setup SSL cert without SSLv3 in my nginx, but SSL Labs say, my server have SSLv3 how to disable it.

My config:

    add_header Strict-Transport-Security max-age=31536000;
    add_header X-Frame-Options DENY;

    ssl_session_cache shared:SSL:10m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains';
  • Have you restarted nginx after updating the configuration? If you've tested the same site with SSL labs do they cache the results of the test, so you're getting a false positive?
    – SamR.
    Oct 31, 2014 at 7:59
  • Yes. I restarted nginx. I think i have wrong ciphers. Oct 31, 2014 at 8:13

3 Answers 3


Here is a good Tutorial how to configure nginx with the best settings.


Your configuration for SSLv3 is correct.

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

In the post is a section for your ciphers.

ssl_ciphers 'AES256+EECDH:AES256+EDH';
  • How to exclude all ciphers with 128 bit and all low quality as RC4? Oct 31, 2014 at 8:57
  • Read the post ;) the system takes only the ciphers your write into your config Oct 31, 2014 at 9:17
  • very strange. I tried connect from console openssl s_client -connect my_site.com:443 -ssl3 and have response SSL-Session: Protocol : SSLv3 Cipher : ECDHE-RSA-RC4-SHA My suite "AES256+EECDH:AES256+EDH:!ECDHE-RSA-RC4-SHA:!EECDH+aRSA+RC4:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS" Where wrong? Oct 31, 2014 at 9:37
  • Have you changed all config files? Perhaps there is another file that is not correct. Oct 31, 2014 at 9:38
  • grep -slir "ssl_ciphers" /etc/nginx/ Oct 31, 2014 at 9:38

I had set my ssl_protocols correctly and could not get it to disable SSLv3, according to https://www.tinfoilsecurity.co... or ssllabs.com 's tests. Eventually I discovered

https://disablessl3.com/#test which mentions trying:

openssl s_client -connect <hostname:443> -ssl3

as the command to test it with. When I did that, I discovered that nginx was using another virtualhost's SSL cert for the initial handshake, rather than the one set up in this specific virtualhost. Once I added in the ssl_protocols line in all virtualhosts that use SSL, it suddenly started working.

  • Upvote because I had another config too that was causing the problem.
    – Danny
    Jun 3, 2015 at 15:46
  • This is VERY important. I was pulling my hair out trying to figure out what was going on!
    – akohlsmith
    Dec 8, 2015 at 4:41

Great i fix it! This is my config

ssl on;
ssl_ciphers 'AES256+EECDH:AES256+EDH::!EECDH+aRSA+RC4:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS';
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_session_cache shared:SSL:10m;

ssl_stapling on;
ssl_stapling_verify on;
resolver valid=300s;
resolver_timeout 10s;

ssl_prefer_server_ciphers on;

add_header Strict-Transport-Security max-age=63072000;
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;

My grade: enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.