How to enable TLSv1 and TLSv1.1

[tanutapi]

Recently I update the Let's Encrypt ACMEv2 by running (refer to #1123 )

mup proxy start

After the process is done, checking with ssllabs.com found that my website is no more support TLS 1.0 and TLS 1.1 which makes my third-part client unable to connect to my API endpoint (they are using the old operating system).

Confirm with mup proxy nginx-config return the following:

Mup version (mup --version):

...
                ssl_protocols TLSv1.2 TLSv1.3;
...
server {
        server_name subdomain.domain.com;
        listen 443 ssl http2 ;
        access_log /var/log/nginx/access.log vhost;
        ssl_session_timeout 5m;
        ssl_session_cache shared:SSL:50m;
        ssl_session_tickets off;
        ssl_certificate /etc/nginx/certs/subdomain.domain.com.crt;
        ssl_certificate_key /etc/nginx/certs/subdomain.domain.com.key;
        ssl_dhparam /etc/nginx/certs/subdomain.domain.com.dhparam.pem;
        ssl_stapling on;
        ssl_stapling_verify on;
        ssl_trusted_certificate /etc/nginx/certs/subdomain.domain.com.chain.pem;
        add_header Strict-Transport-Security "max-age=31536000" always;
        include /etc/nginx/vhost.d/default;
        location / {
                proxy_pass http://subdomain.domain.com;
        }
}

Trying to directly make a modification in mup-nginx-proxy /etc/nginx/conf.d/default.conf and do service nginx reload is not success.

How could I make a change to ssl_protocols to have TLSv1 and TLSv1.1?

Best regards, Tanut

[tanutapi]

I found the solution. SSL_POLICY environment must be passed to nginx, in this case Mozilla-Old.

module.exports = {
  ...
  proxy: {
    domains: 'yourdomain.com',
    ssl: {
      // Enable let's encrypt to create free certificates
      letsEncryptEmail: 'youremail@yourdomain.com',
      forceSSL: true
    },
    shared: {
      env: {
        SSL_POLICY: "Mozilla-Old",
      },
    },
  },
  ...

More information here: https://github.com/jwilder/nginx-proxy/blob/0dfe09fb7c5315ae7d5b91c042c3144a1b749e37/README.md#how-ssl-support-works