Our webserver has recently failed a PCI compliance test due to existence of "TLS Session Renegotiation Vulnerability" (CVE-2009-3555) However I'm not sure whether those results are right. We're using nginx version 1.6.2, with openssl version 1.0.2.

As far as I know any kind of renegotiation is disabled in nginx since version 0.8.23. Qualsys SSL test results show that "SSL Secure Renegotiation" is enabled, but secure (and insecure) client initiated renegotiation are not.

Here's how an openssl session looks like :

$ openssl s_client -connect
<blah, blah, blah>
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
    Protocol  : TLSv1.2
<blah blah>
GET / HTTP/1.1
140392261871432:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl  handshake failure:s3_pkt.c:596:

What am I missing here? Is there a way to completely disable renegotiation in nginx?

  • Where is this server? You gave the wrong IP address. – Michael Hampton Apr 22 '15 at 6:00
  • You're right. Fixed. – aqz Apr 22 '15 at 6:12
  • Without posting your configuration and describing your setup, it's very hard to help you. – sebix May 10 '15 at 12:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.