Closed lifeofguenter closed 3 years ago
Aha, the issue was other interfering vhosts: https://github.com/mozilla/ssl-config-generator/issues/76#issuecomment-579265280
After removing curve config option everywhere it worked :)
@lifeofguenter Is there an improvement that could be made to the config that the tool offers to prevent others from having the same issue where there was interference from another vhost?
@gene1wood in my case I completely forgot about other vhost configs and assumed I only had one that server, so even if there was a warning, it was only me double checking where I realized the issue.
I did put 1+1 together quite quick, because I saw the github issue earlier. So maybe explicitly setting:
# Be aware of nginx <> openssl bugs with different config values in other server blocks.
# See: https://github.com/mozilla/ssl-config-generator/issues/76#issuecomment-579265280
ssl_ecdh_curve auto;
might help (but not sure).
With the following generated config: https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1d&guideline=5.6
I am getting on client side:
Windows 10 + Edge latest
Windows 10 + Firefox latest
Server side I see:
Access via curl works, but many other clients fail.
Setting
ssl_prefer_server_ciphers
toon
solves the issue though.