Nginx sslv3 poodle disable

Question

I tried setup SSL cert without SSLv3 in my nginx, but SSL Labs say, my server have SSLv3 how to disable it.

My config:

    add_header Strict-Transport-Security max-age=31536000;
    add_header X-Frame-Options DENY;

    ssl_session_cache shared:SSL:10m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers "EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA256:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EDH+aRSA+AESGCM:EDH+aRSA+SHA256:EDH+aRSA:EECDH:!aNULL:!eNULL:!MEDIUM:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4:!SEED";
    ssl_prefer_server_ciphers on;
    add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains';

Have you restarted nginx after updating the configuration? If you've tested the same site with SSL labs do they cache the results of the test, so you're getting a false positive? — SamR., Oct 31 '14 at 07:59

score 6 · Accepted Answer · answered Oct 31 '14 at 08:40

6

Here is a good Tutorial how to configure nginx with the best settings.

https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html

Your configuration for SSLv3 is correct.

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

In the post is a section for your ciphers.

ssl_ciphers 'AES256+EECDH:AES256+EDH';

answered Oct 31 '14 at 08:40

René Höhle

1,418
3
17
26

How to exclude all ciphers with 128 bit and all low quality as RC4? – Rinat Mukhamedgaliev Oct 31 '14 at 08:57
Read the post ;) the system takes only the ciphers your write into your config – René Höhle Oct 31 '14 at 09:17
very strange. I tried connect from console openssl s_client -connect my_site.com:443 -ssl3 and have response SSL-Session: Protocol : SSLv3 Cipher : ECDHE-RSA-RC4-SHA My suite "AES256+EECDH:AES256+EDH:!ECDHE-RSA-RC4-SHA:!EECDH+aRSA+RC4:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS" Where wrong? – Rinat Mukhamedgaliev Oct 31 '14 at 09:37
Have you changed all config files? Perhaps there is another file that is not correct. – René Höhle Oct 31 '14 at 09:38
grep -slir "ssl_ciphers" /etc/nginx/ – René Höhle Oct 31 '14 at 09:38
I have my files with configs. Can i set it globaly? – Rinat Mukhamedgaliev Oct 31 '14 at 09:40

score 6 · Answer 2 · answered Jan 16 '15 at 13:12

6

I had set my ssl_protocols correctly and could not get it to disable SSLv3, according to https://www.tinfoilsecurity.co... or ssllabs.com 's tests. Eventually I discovered

https://disablessl3.com/#test which mentions trying:

openssl s_client -connect <hostname:443> -ssl3

as the command to test it with. When I did that, I discovered that nginx was using another virtualhost's SSL cert for the initial handshake, rather than the one set up in this specific virtualhost. Once I added in the ssl_protocols line in all virtualhosts that use SSL, it suddenly started working.

answered Jan 16 '15 at 13:12

Daniel

180
3
7

Upvote because I had another config too that was causing the problem. – Danny Jun 03 '15 at 15:46
This is *VERY* important. I was pulling my hair out trying to figure out what was going on! – akohlsmith Dec 08 '15 at 04:41

score 2 · Answer 3 · answered Oct 31 '14 at 10:28

Great i fix it! This is my config

ssl on;
ssl_ciphers 'AES256+EECDH:AES256+EDH::!EECDH+aRSA+RC4:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS';
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_session_cache shared:SSL:10m;

ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.4.4 8.8.8.8 valid=300s;
resolver_timeout 10s;

ssl_prefer_server_ciphers on;

add_header Strict-Transport-Security max-age=63072000;
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;

My grade: enter image description here

Nginx sslv3 poodle disable

3 Answers3

Linked

Related