nginx seems to be ignoring ssl_ciphers setting

Question

I am attempting to restrict nginx to avoid the use of ciphers that use DH algorithms for Key Exchange.

To force this, I set the ssl_ciphers to a single suite:

ssl_ciphers 'AES256-GCM-SHA384';

After restarting nginx, I can see from the access log it still chooses other ciphers (in this case, DHE-RSA-AES128-GCM-SHA256):

10.162.10.235 [02/Feb/2017:15:09:09 +0000] "GET /images/favicon.ico HTTP/1.1" 200 0 "https://example.com/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.95 Safari/537.36" 0.001 - "" "DHE-RSA-AES128-GCM-SHA256" "TLSv1.2" "-" "xxx" "r" - -

I must be misunderstanding how that ssl_ciphers directive works. I also tried setting it to '!DH:!ECDH' but then it seems like it can't agree on a compatible cipher at all.

What should the setting be to force the use of AES256-GMC-SHA384?

Answer 1

I was restarting nginx but I believe it was only restarting the master process and loading the new configuration in that process. Exsiting worker processes apparently still had the old configuration.

I was restarting nginx that caused the issue. I was using the command:

service nginx restart 

It turns out there are several different ways to force nginx to reload its configuration but the way the service was configured it wasn't using any of these methods.

For my purposes it was sufficient to just stop the service and wait for a minute or two before starting it again.