Open gene1wood opened 3 years ago
Thanks @gene1wood!
I have moved in /etc/nginx/nginx.conf
all these ssl directives within the http
context:
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:10m; # about 40000 sessions
ssl_session_tickets off;
ssl_dhparam /etc/nginx/ssl/dhparam_4096.pem;
# intermediate configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_ecdh_curve x25519:prime256v1:secp384r1;
ssl_prefer_server_ciphers off;
ssl_ecdh_curve
is now working and did not work in the server
context.
Nginx documentation is flawed as they still reference both the support of the http
and the server
contexts for most of ssl directives.
Furthermore, as I have at least one self-signed TLS certificate, I prefer to keep the OCSP configuration within theserver
context in a file named ocsp_params
located within the root /etc/nginx configuration folder:
# OCSP Stapling ---
ssl_stapling on;
ssl_stapling_verify on;
resolver 9.9.9.9 valid=300s;
resolver_timeout 5s;
At least ssl_protocols
and ssl_ecdh_curve
MUST be only located within the http
context.
And read some interesting comment: https://github.com/mozilla/ssl-config-generator/issues/124#issuecomment-1289968597.
Nginx documentation is flawed as they still reference both the support of the
http
and theserver
contexts for most of ssl directives.
Nginx support both the http
and the server
contexts for most of ssl directives. Yes, this is true.
Ngixn documentation is not complete reference for all use cases, more information about correct nginx configuration located in nginx trac and nginx maillists.
At least
ssl_protocols
andssl_ecdh_curve
MUST be only located within thehttp
context.
No! This is not true. ssl_protocols
also can be located in the server
context.
In different IP-based (or port-based) virtual servers are quite possible use different ssl_protocols.
You tries to set different ssl_protocols in name-based virtual servers. This will not work, because OpenSSL fixes protocol before the name is known. At the same time, in different IP-based (or port-based) virtual servers are quite possible use different ssl_protocols.
And read some interesting comment: #124 (comment).
Yes, this is my comment with detailed explain how ssl directives work in the nginx.
I copy text of that my message here:
This is not nginx bugs. Bugs are in your configuration and expectations.
More about this is here:
https://trac.nginx.org/nginx/ticket/676 https://mailman.nginx.org/pipermail/nginx/2014-November/045738.html
This and other nuances of applying configuration for name-based virtual servers are documented here:
http://nginx.org/en/docs/http/server_names.html#virtual_server_selection
Currently the nginx template doesn't assert an
http
context and just containsserver
contexts.In the template's
server
context we assertssl_protocols
As mentioned in #76 the
ssl_protocols
directive is not actually specific to each vhost. According to https://trac.nginx.org/nginx/ticket/844So for clarity (that the
ssl_protocols
is not per vhost) how about we move it out of theserver
context and into a parenthttp
context?We see someone encountering this problem in #140