0

I am using the official nginx:1.15.5 image with the following settings:

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256;

The handshake with some ciphers fails:

openssl s_client -cipher "$cipher" -connect $SERVER

Testing ECDHE-ECDSA-AES128-SHA256...NO (sslv3 alert handshake failure)

I attached into the nginx container and checked:

openssl ciphers and the cipher mentioned above was within the output.

I am running out of ideas, what could be the reason that the handshake with some ciphers both configured in nginx and provided by openssl fails?

1 Answer 1

2

RSA ciphers need a certificate with an RSA public key and ECDSA ciphers need a certificate with an ECC public key. Likely you only have a certificate with an RSA public key (still most common) and thus only the RSA ciphers will work but not the ECDSA ciphers.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .