Using OpenSSL 3.0.1 and TLS 1.1 and lower will usually fail

[PSanetra]

Support for TLS 1.1 and lower was moved to security level 0 in OpenSSL 3.0.1. This implies by default usually those protocolls will not be supported without further configuration.

Reproduce

• Server Software: nginx
• Mozilla Configuration: Old
• Server Version: 1.23.0
• OpenSSL Version: 3.0.1

The configuration will generate a nginx configuration that lists TLS 1.1 and 1.0, but those protocols will usually not work when OpenSSL 3.0.1 or higher is used at the same time.

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;

Starting an nginx server with this configuration and issuing a TLS 1.1 or TLS 1.0 request against it will result in a SSL error like the following:

2023/01/02 17:41:13 [info] 39#39: *2 SSL_do_handshake() failed (SSL: error:0A000076:SSL routines::no suitable signature algorithm) while SSL handshaking, client: 192.168.192.3, server: 0.0.0.0:443

Related: https://github.com/nginxinc/docker-nginx/issues/743

[ghen2]

Does it work if you append :@SECLEVEL=0 to your cipher string?

This may have more implications than just re-enabling TLSv1.0 and 1.1 (or rather: SHA1 and MD5 signature algorithms, used by these protocols) though, depending on the OpenSSL version. See man SSL_CTX_set_security_level(3) on the same machine.

[gstrauss]

256 puts @SECLEVEL=0 at the beginning of the cipher string for openssl 3.0.0 and later, for ssl-config-generator Old configuration (which uses TLSv1 and TLSv1.1)

[gstrauss]

From https://docs.openssl.org/master/man3/SSL_CTX_set_security_level/

• Level 0 Everything is permitted. This retains compatibility with previous versions of OpenSSL.

• Level 1 The security level corresponds to a minimum of 80 bits of security. Any parameters offering below 80 bits of security are excluded. As a result RSA, DSA and DH keys shorter than 1024 bits and ECC keys shorter than 160 bits are prohibited. Any cipher suite using MD5 for the MAC is also prohibited. Any cipher suites using CCM with a 64 bit authentication tag are prohibited. Note that signatures using SHA1 and MD5 are also forbidden at this level as they have less than 80 security bits. Additionally, SSLv3, TLS 1.0, TLS 1.1 and DTLS 1.0 are all disabled at this level.