0

Spent many hours, but can't fix it. I'm not able to disable TLS 1.1. That's required to use Stripe or any other CC gateway for my Wordpress Woocommerce based shop.

Domain name: russianphilately.com

CentOS 6

Front: nginx, back: apache.

nginx version: nginx/1.4.1 OpenSSL 1.0.2p

Nginx listens 80 and 443 ports for all IPs on the server. The default nginx config file has an empty section for 443, but has records to listen 80 and 443 ports for all IPs.

The virtual host nginx config file is:

<pre>
<code>
server {
listen 149.56.235.139:80;
server_name russianphilately.com www.russianphilately.com;
return 301 https://$host$request_uri;
}
server {
#listen 149.56.235.139:80;
listen 149.56.235.139:443 default_server ssl;
server_name russianphilately.com www.russianphilately.com;
root /home/httpd/vhosts/russianphilately.com/httpdocs;

ssl_certificate    /etc/nginx/ssl/russianphilately.com_bundle.crt;
ssl_certificate_key /etc/nginx/ssl/russianphilately.com.key;
ssl_protocols TLSv1.2;
ssl_prefer_server_ciphers   on;
ssl_session_cache    shared:SSL:10m;
ssl_session_timeout 10m;
ssl_dhparam dhparam.pem;
#ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-
RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:EC
DHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
#ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:ECDHE-RSA-AES128-GCM-SHA256:AES256+EECDH:DHE-RSA-AES128-GCM-SHA256:AES
256+EDH:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA25
6:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:D
HE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA
256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
#ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:ECDHE-RSA-AES128-GCM-SHA256:AES256+EECDH:AES256+EDH:ECDHE-RSA-AES256-G
CM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RS
A-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC
3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
#ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA
256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4:@STRENGT
H";
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA2
56:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4:@STRENGTH
";
#ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-
RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:EC
DHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256";
#ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-
RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:EC
DHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
ssl_ecdh_curve secp384r1;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; always";
add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;
gzip on;
gzip_min_length 1100;
gzip_buffers 4 32k;
gzip_types text/plain application/x-javascript text/xml text/css;
gzip_vary on;

location / {
proxy_pass http://127.0.0.1:8080/;
#fastcgi_param  HTTPS on;
fastcgi_param SERVER_PORT 80;
#proxy_redirect http://localhost:8000/zemstvo/ http://russianphilately.com/c/zemstvo/;
rewrite ^/?zemstvo/a-c/(.*)$ /c/zemstvo/$1 redirect;
rewrite ^/?zemstvo/a-c/(.*)$ /c/zemstvo/$1 redirect;
rewrite ^/?zemstvo/d-k/(.*)$ /c/zemstvo/$1 redirect;
rewrite ^/?zemstvo/l-o/(.*)$ /c/zemstvo/$1 redirect;
rewrite ^/?zemstvo/p-s/(.*)$ /c/zemstvo/$1 redirect;
rewrite ^/?zemstvo/t-z/(.*)$ /c/zemstvo/$1 redirect;
rewrite ^/?zemstvo/(.*)$ /c/zemstvo/$1 redirect;
rewrite ^/?empire-1857-1917/(.*)$ /c/empire-1857-1917/$1 redirect;
rewrite ^/?ussr-1923-1940/(.*)$ /c/ussr-1923-1940/$1 redirect;
rewrite ^/?ukraine/(.*)$ /c/ukraine/$1 redirect;
rewrite ^/?civil-war/(.*)$ /c/civil-war/$1 redirect;
#rewrite ^/(.*)/$ /$1 permanent;
}

location ~ /\.ht {
deny all;
}

location ~* \.(gif|jpg|png|js|css|ico)$ {
expires 30d;
access_log  /home/httpd/vhosts/russianphilately.com/logs/static_access_log;
}
#if ( $request_filename ~ russianphilately.com/zemstvo/ ) {
#rewrite ^ http://russianphilately.com/c/zemstvo/? permanent;
#}
#if ( $request_uri ~ russianphilately.com/zemstvo/.+ ) {
#rewrite ^(.*) http://russianphilately.com/c/zemstvo/$1 permanent;
#}
#location ^~ /zemstvo/(.*) {
#  return 301 $scheme://$http_host/c/zemstvo/$1$is_args$query_string;
#  }



}

</code>
</pre>

Only this website is running on that IP, so no one else use it. All virtual host configs contain only ssl_protocols TLSv1.2. Any records for any other protocols are removed from nginx and even apache configs.

The services and the server were rebooted many times, but TLSv1.1 is still available. ssltest.com shows cipher suites for # TLS 1.1 (and shows ciphers not listed in this config!) and says

TLS 1.3 No TLS 1.2 Yes TLS 1.1 Yes TLS 1.0 No

    # TLS 1.1 (suites in server-preferred order)
    TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x39)   DH 4096 bits   FS 256
    TLS_RSA_WITH_AES_256_CBC_SHA (0x35)   WEAK  256
    TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA (0x88)   DH 4096 bits   FS    256
    TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (0x84)   WEAK 256
    TLS_RSA_WITH_AES_128_CBC_SHA (0x2f)   WEAK  128
    TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x33)   DH 4096 bits   FS 128
    TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA (0x45)   DH 4096 bits   FS    128
    TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (0x41)   WEAK 128
    TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa)   WEAK  112
    TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA (0x16)   DH 4096 bits   FS   WEAK 112

Chrome says: Connection - obsolete connection settings The connection to this site uses TLS 1.2 (a strong protocol), RSA (an obsolete key exchange), and AES_256_GCM (a strong cipher).

I have no idea where else to search for tls 1.1 configs and how to fix it... Thanks for any help!

[root@ks4002647 ~]# grep -ri "TLSv1.1" /etc/nginx [root@ks4002647 ~]#

[root@ks4002647 ~]# grep -ri "TLSv1.1" /etc Binary file /etc/httpd/modules/libphp5.so matches Binary file /etc/httpd/modules/mod_ssl.so matches Binary file /etc/httpd/modules/libphp5-zts.so matches /etc/httpd/conf.d/ssl.conf:SSLProtocol TLSv1.2 -TLSv1.1

  • 1
    Please edit your question to include your domain name. It's much easier to have a look directly to see what Nginx returns. Your config looks fine to me, mine is very similar, other than there's no point putting default_ server on an ssl server block and I don't specify the IP address in the listen line. – Tim Sep 27 '18 at 4:12
  • Please edit your question to include your full Nginx configuration, including all server blocks. What you've posted looks fine. I'd also like you to verify requests for russianphilately.com are definitely reaching that server - check your access logs. – Tim Sep 27 '18 at 19:41
  • Please don't put logs into comments, they're unreadable. Please edit your question to include them, properly formatted. You don't need to include logs anyway, as we don't know your IP address it doesn't help us to help you. You just need to be 100% sure requests for that domain are arriving your server. – Tim Sep 27 '18 at 23:20
0

Once I fooled myself

The test results on SSL Labs' site are cached so when you run the test again make sure you click "Clear cache" on the result page to start a new test for real.

enter image description here

Includes

Your config looks fine. However we don't see the full server part of the config so it might be some external include file which overwrites your ssl configuration. For example the one certbot inserts when installing a Let's Encrypt certificate with nginx autoconfig switch: include /etc/letsencrypt/options-ssl-nginx.conf. Make sure you comment out that include.

Grep

If none of the above helps then search for config files using TLSv1.1.

grep -ri "TLSv1.1" /etc/nginx
  • Thanks, but I know it. Refreshed many times, used different browsers. – user489534 Sep 27 '18 at 13:17
  • Added to the first post. Only this file has listen 149.56.235.139:443, so I don't think I have to post all other includes. They are similar for all domains, but have diffrent ip addresses. And only this domain uses 149.56.235.139 address. – user489534 Sep 27 '18 at 20:51
  • Empty answer... – user489534 Sep 28 '18 at 22:58
  • @user489534 Any chance to upgrade Nginx to a more up-to-date version? Maybe it's a version specific bug with this Linux distro. – bcs78 Sep 29 '18 at 16:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.