sslnginxssl-certificatesslv3

Disable SSLv3 on Nginx

Why on my server still enabled SSLv3 ? I want to disable for reasons that in some computers can not open my page because of safety issues.

I found this guide:

enter image description here

But currently I've got it set. My server is hosted in Google Cloud, I currently have this Nginx configuration file:

...
ssl on;
ssl_certificate /etc/nginx/dba_certs/dba_ssl2/ssl-bundle.crt;
ssl_certificate_key /etc/nginx/dba_certs/dba_keys/dba.key;

ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
ssl_prefer_server_ciphers on;
...

OpenSSL version is 1.0.1f 6 Jan 2014.

enter image description here

What could be wrong?

Solution

  • To disable SSLv3, you'll have to edit default server configuration, not just an arbitrary virtual host config. It can only be disabled for a listen socket, not just a virtual server. The configuration snippet you've provided suggests that you are using per-server included configuration files, so you'll have to find one with default_server in the appropriate listen directive, and disable SSLv3 there:

    server {
    listen 443 default_server ssl;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ...
}

    Or, better yet, edit the configuration at http level, in nginx.conf:

    http {
    ...
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ...
}

    You may also consider upgrading nginx to a recent version. In nginx 1.9.1+ SSLv3 is disabled by default.