0

For a website of mine (https://brejoc.com) I wanted to set up a decent HTTPS configuration that would also support TLS version 1.2. Most of the modern browsers support that by now. So I generated a certificate with StartSSL. Everything but Nignx 1.8.0-1+trusty1 comes from the official repositories. Nginx was installed from Launchpad (http://ppa.launchpad.net/nginx/stable/ubuntu). OpenSSL version 1.0.1f-1ubuntu2.15 should be fine too.

The relevant part of the Nginx config looks like this:

ssl_session_timeout 5m;
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
ssl_ciphers EECDH+AESGCM:EDH+AESGCM:EECDH:EDH:!MD5:!RC4:!LOW:!MEDIUM:!CAMELLIA:!ECDSA:!DES:!DSS:!3DES:!NULL;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;

Checking the website with https://www.ssllabs.com/ssltest tells me, that TLS1.2 is not supported. I've tried several other cipher combinations, but nothing worked. The cipher list of https://cipherli.st/ won't work at all.

|improve this question
  • I was just digging around and found an answer to a related question for Ubuntu 12.04: askubuntu.com/a/441638/43783 There was mentioned that Nginx might very well be linked against an other OpenSSL version and that also seems to be true for this version. It is not linked against the installed version 1.0.1, but 1.0.0. – brejoc Sep 18 '15 at 15:20
  • You need to research your information. The libssl-dev is a build-dep. It's 1.0.1. You need to give us more information. Error logs from nginx'serror logs, etc. And a copy of your config would be nice too, sanitized to remove secret information. – Thomas Ward♦ Sep 18 '15 at 15:58
  • Using the SSL sections you've stated here, a valid SSL certificate, and the same PPA and OS on Ubuntu 14.04 locally, I get these results from an SSL Testing script: paste.ubuntu.com/12450334/plain – Thomas Ward♦ Sep 18 '15 at 16:10
  • I've been checking the shared lib dependencies - and there libssl 1.0.0 is included. That raised some suspicions. Here is the complete Nginx-config. And the ouput from apt-cache policy openssl and apt-cache policy nginx nginx-common: paste.ubuntu.com/12450954 paste.ubuntu.com/12450976 The error logs are clean. Nothing that would give any indiacation that someting is wrong. – brejoc Sep 18 '15 at 17:18
  • Package results on an actual Ubuntu system. Take a look at the output of apt-cache policy libssl1.0.0, if it's 1.0.1f-1ubuntu2.15 installed, the library there is libssl 1.0.1. – Thomas Ward♦ Sep 18 '15 at 17:30
1

Through chat, we discovered that all but one site config had ssl_protocols TLSv1; in their configurations. Just one had ssl_protocols TLSv1 TLSv1.1 TLSv1.2; in the site config. We removed them all, and had /etc/nginx/nginx.conf defined with ssl_protocols TLSv1 TLSv1.1 TLSv1.2; which appears to have solved their issues.

|improve this answer
  • Just one quick annotation. According to the docs both should be possible; the context for ssl_protocols can be http and server. But writing those settings once into the nginx.conf saves time and work. – brejoc Sep 18 '15 at 20:41
  • I've found the ticket addressing this issue. It is only possible to use different SSL protocols on distinct ports. Sadly this is not mentioned in the documentation. – brejoc Sep 20 '15 at 6:27
  • @brejoc Sadly they were unable to reproduce and therefore the issue was invalidated... – Thomas Ward♦ Sep 20 '15 at 12:24

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.