For a website of mine (https://brejoc.com) I wanted to set up a decent HTTPS configuration that would also support TLS version 1.2. Most of the modern browsers support that by now. So I generated a certificate with StartSSL. Everything but Nignx 1.8.0-1+trusty1 comes from the official repositories. Nginx was installed from Launchpad (http://ppa.launchpad.net/nginx/stable/ubuntu). OpenSSL version 1.0.1f-1ubuntu2.15 should be fine too.

The relevant part of the Nginx config looks like this:

ssl_session_timeout 5m;
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;

Checking the website with https://www.ssllabs.com/ssltest tells me, that TLS1.2 is not supported. I've tried several other cipher combinations, but nothing worked. The cipher list of https://cipherli.st/ won't work at all.

  • I was just digging around and found an answer to a related question for Ubuntu 12.04: askubuntu.com/a/441638/43783 There was mentioned that Nginx might very well be linked against an other OpenSSL version and that also seems to be true for this version. It is not linked against the installed version 1.0.1, but 1.0.0.
    – brejoc
    Sep 18, 2015 at 15:20
  • You need to research your information. The libssl-dev is a build-dep. It's 1.0.1. You need to give us more information. Error logs from nginx'serror logs, etc. And a copy of your config would be nice too, sanitized to remove secret information.
    – Thomas Ward
    Sep 18, 2015 at 15:58
  • Using the SSL sections you've stated here, a valid SSL certificate, and the same PPA and OS on Ubuntu 14.04 locally, I get these results from an SSL Testing script: paste.ubuntu.com/12450334/plain
    – Thomas Ward
    Sep 18, 2015 at 16:10
  • I've been checking the shared lib dependencies - and there libssl 1.0.0 is included. That raised some suspicions. Here is the complete Nginx-config. And the ouput from apt-cache policy openssl and apt-cache policy nginx nginx-common: paste.ubuntu.com/12450954 paste.ubuntu.com/12450976 The error logs are clean. Nothing that would give any indiacation that someting is wrong.
    – brejoc
    Sep 18, 2015 at 17:18
  • Package results on an actual Ubuntu system. Take a look at the output of apt-cache policy libssl1.0.0, if it's 1.0.1f-1ubuntu2.15 installed, the library there is libssl 1.0.1.
    – Thomas Ward
    Sep 18, 2015 at 17:30

1 Answer 1


Through chat, we discovered that all but one site config had ssl_protocols TLSv1; in their configurations. Just one had ssl_protocols TLSv1 TLSv1.1 TLSv1.2; in the site config. We removed them all, and had /etc/nginx/nginx.conf defined with ssl_protocols TLSv1 TLSv1.1 TLSv1.2; which appears to have solved their issues.

  • Just one quick annotation. According to the docs both should be possible; the context for ssl_protocols can be http and server. But writing those settings once into the nginx.conf saves time and work.
    – brejoc
    Sep 18, 2015 at 20:41
  • I've found the ticket addressing this issue. It is only possible to use different SSL protocols on distinct ports. Sadly this is not mentioned in the documentation.
    – brejoc
    Sep 20, 2015 at 6:27
  • @brejoc Sadly they were unable to reproduce and therefore the issue was invalidated...
    – Thomas Ward
    Sep 20, 2015 at 12:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .