For a website of mine (https://brejoc.com) I wanted to set up a decent HTTPS configuration that would also support TLS version 1.2. Most of the modern browsers support that by now. So I generated a certificate with StartSSL. Everything but Nignx 1.8.0-1+trusty1 comes from the official repositories. Nginx was installed from Launchpad (http://ppa.launchpad.net/nginx/stable/ubuntu). OpenSSL version 1.0.1f-1ubuntu2.15 should be fine too.
The relevant part of the Nginx config looks like this:
ssl_session_timeout 5m;
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
ssl_ciphers EECDH+AESGCM:EDH+AESGCM:EECDH:EDH:!MD5:!RC4:!LOW:!MEDIUM:!CAMELLIA:!ECDSA:!DES:!DSS:!3DES:!NULL;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
Checking the website with https://www.ssllabs.com/ssltest tells me, that TLS1.2 is not supported. I've tried several other cipher combinations, but nothing worked. The cipher list of https://cipherli.st/ won't work at all.
libssl-dev
is a build-dep. It's 1.0.1. You need to give us more information. Error logs from nginx'serror logs, etc. And a copy of your config would be nice too, sanitized to remove secret information. – Thomas Ward♦ Sep 18 '15 at 15:58apt-cache policy openssl
andapt-cache policy nginx nginx-common
: paste.ubuntu.com/12450954 paste.ubuntu.com/12450976 The error logs are clean. Nothing that would give any indiacation that someting is wrong. – brejoc Sep 18 '15 at 17:18apt-cache policy libssl1.0.0
, if it's1.0.1f-1ubuntu2.15
installed, the library there islibssl
1.0.1. – Thomas Ward♦ Sep 18 '15 at 17:30