4

Relevant config:

ssl_protocols TLSv1.2;

When I test the server at SSL Labs, the test reports that TLS 1.3 is available and lists the default ciphers and other results as if TLSv1.3 were included in my config.

Ubuntu Server 18.04.1, OpenSSL 1.1.1 11 Sep 2018, Nginx 1.14.1 built with OpenSSL 1.1.0g

How can I disable TLSv1.3?

2
3

Nginx 1.14.1 built with OpenSSL 1.1.0g

OpenSSL 1.1.0 does not support TLS 1.3

Ubuntu Server 18.04.1, OpenSSL 1.1.1 11 Sep 2018

Ubuntu 18.04.1 comes with OpenSSL 1.1.0g not with OpenSSL 1.1.1.

My guess is that you somehow installed OpenSSL 1.1.1 on your system in a way that replaced the version which comes with the OS. Because nginx uses shared libraries it will use the OpenSSL 1.1.1 you have installed even though it was compiled against OpenSSL 1.1.0g.

The option ssl_protocols TLSv1.2; in nginx is not implemented by only enabling TLS 1.2. Instead all useful protocols are enabled by default and restricting it to TLS 1.2 effectively means that everything but TLS 1.2 gets disabled. But, it can only disable protocols it is aware of and given that nginx was compiled against an OpenSSL version without TLS 1.3 support it is not aware that TLS 1.3 exists and also has no way to disable it, which means that it stays enabled.

3
  • 1
    Apparently the OpenSSL version is installed over default repository because I use the sury.org PHP PPA. – Paul Nov 23 '18 at 20:33
  • @Paul: yes, the openssl packages there seem to replace the system packages. – Steffen Ullrich Nov 23 '18 at 20:39
  • 2
    It looks likes this was a bug that affected 1.14.x and has been patched with the release of 1.14.2. – Paul Dec 6 '18 at 1:14
1

Looking at the comment:

Apparently the OpenSSL version is installed over default repository because I use the sury.org PHP PPA.

To fix you also need to install the sury.org repo version of nginx. At time of writing this version of nginx is built with openssl 1.1.1b and TLS 1.3 which is required if we use the ondrej php7.3 lib which replaces the default ubuntu openssl package.

i had to do the same as i was getting a ERR_SSL_VERSION_INTERFERENCE ssl error in chrome.

before:

sudo nginx -V
built with OpenSSL 1.1.0g  2 Nov 2017 (running with OpenSSL 1.1.1b  26 Feb 2019)

run the following:

sudo add-apt-repository ppa:ondrej/nginx
sudo apt update
sudo apt remove nginx
sudo apt install nginx

after:

sudo nginx -V
built with OpenSSL 1.1.1  11 Sep 2018 (running with OpenSSL 1.1.1b  26 Feb 2019)

full instructions here:

https://www.linuxbabe.com/ubuntu/enable-tls-1-3-nginx-ubuntu-18-10-18-04-16-04-14-04

1
  • I upgraded my server : it is now vulnerable to Secure Renegotiation (CVE-2009-3555) VULNERABLE (NOT ok). Any idea ? – Jean-Philippe Caruana Dec 30 '19 at 14:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.