How can I resolve this so I can enable TLSv1.1 & TLSv1.2?
It sounds like there are two issues in play. First is
nginx related; and second is
openssl related. There could be a third, and that's Amazon.
nginx can be built with OpenSSL. When it is, its built with the version of OpenSSL provided by the platform. Ubuntu 12.04 provides OpenSSL 1.0.1, and not 0.9.8. So you'll need to confirm that you are actually using 0.9.8 in
To verify the version of OpenSSL used by
ldd nginx. For example here's the
openssl executable's dependency (I don't use
nginx, so I don't have it installed. You should swap in
$ which openssl
$ ldd /usr/bin/openssl
linux-vdso.so.1 => (0x00007ffff69ff000)
libssl.so.1.0.0 => /usr/lib/x86_64-linux-gnu/libssl.so.1.0.0 (0x00007f136424f000)
libcrypto.so.1.0.0 => /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0 (0x00007f1363e58000)
libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f1363c53000)
libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007f1363a3c000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f13636b1000)
In the above,
libssl are OpenSSL.
From the above, you can check the packages like at libssl.so.1.0.0. Below, the 1.0.1 is OpenSSL's version
* Package: libssl1.0.0 (1.0.1-4ubuntu5.11)
The lack of TLS 1.1 and 1.2 is probably due to Ubuntu's security team disabling the protocol versions in an effort to promote interoperability. See Ubuntu 12.04 LTS: OpenSSL downlevel version and does not support TLS 1.2.
Amazon may be providing images that are further modified. So the discussions about
openssl might not apply or be wrong, depending on what Amazon did (or did not) do.
If you don't like the
nginx as provided by the platform (either Ubuntu or Amazon), then you can try
nginx's PPA. See nginx - Ubuntu PPA.
You can also build it from sources. Be sure to install OepnSSL's developer package (
libssl-dev). You'll need two or three additional packages, IIRC.
Sorry to bring in the bug report. That will probably cause this question to be closed. Please accept my apologies.