I am attempting to restrict nginx to avoid the use of ciphers that use DH algorithms for Key Exchange.
To force this, I set the ssl_ciphers to a single suite:
After restarting nginx, I can see from the access log it still chooses other ciphers (in this case, DHE-RSA-AES128-GCM-SHA256):
10.162.10.235 [02/Feb/2017:15:09:09 +0000] "GET /images/favicon.ico HTTP/1.1" 200 0 "https://example.com/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.95 Safari/537.36" 0.001 - "" "DHE-RSA-AES128-GCM-SHA256" "TLSv1.2" "-" "xxx" "r" - -
I must be misunderstanding how that ssl_ciphers directive works. I also tried setting it to '!DH:!ECDH' but then it seems like it can't agree on a compatible cipher at all.
What should the setting be to force the use of AES256-GMC-SHA384?