I'm having an issue trying to disable SSLv3 on my nginx installation.
HTTPS works fine, but I just can't seem to disable SSLv3 and it makes my site vulnerable to the POODLE attack. Also, for some reason the connection is encrypted over 128-bit instead of 256-bit even though I got a 256-bit certificate.
Nginx version: 1.6.2
Here's what I entered into my server block on the site I wanted to use:
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers On; ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS;