0

I am setting up nginx (v1.16.1, OpenSSL 1.1.1) to use https. I use letsencrypt certificate - SHA-256 with RSA encryption. I use TLSv1.2 I test for ssllabs and observatory. Prescribed encryption next line

ssl_ciphers DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256;

I test and get that only ECDHE is detected. I tried various combinations.

ecdhe

The problem is that I need encryption to work correctly with IE11 in versions of Win 7 and Win 8.1, and when testing I get an error

"Server sent fatal alert: handshake_failure"

If on the same ssllabs I see the supported certificates for IE11 Win7, then the support that I am trying to use is indicated.

LS_DHE_RSA_WITH_AES_256_GCM_SHA384

TLS_DHE_RSA_WITH_AES_128_GCM_SHA256

win7ie11

If I specify a bunch of extra supported encryption, then everything will be fine, but all other encryption methods are WEAK.

OpenSSL supports this type of cipher

$ openssl ciphers -v | grep DHE-RSA-AES128-GCM-SHA256
ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(128)    Mac=AEAD
DHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(128) Mac=AEAD

Config:

server {
listen            443 ssl http2;
server_name       test.ru;

ssl_protocols           TLSv1.2;
ssl_certificate         /etc/nginx/conf.d/ssl/fullchain.pem;
ssl_certificate_key     /etc/nginx/conf.d/ssl/privkey.pem;
ssl_ciphers DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256;
ssl_ecdh_curve secp384r1;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
add_header Strict-Transport-Security "max-age=63072000" always;

location / {
        proxy_pass            http://192.168.1.2;
        proxy_redirect        off;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_ssl_server_name on;
        proxy_ssl_name test.ru;
        proxy_set_header Host $http_host;
        proxy_pass_header Set-Cookie;
}

What could be the reason?

1

You need to set ssl_dhparam (see https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam) for DHE ciphers to work on nginx.

Quote from the documentation:

By default no parameters are set, and therefore DHE ciphers will not be used.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.