Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ssl_prefer_server_ciphers off causes TLS level Non-compliant #394

Open
SagePtr opened this issue Sep 25, 2019 · 1 comment
Open

ssl_prefer_server_ciphers off causes TLS level Non-compliant #394

SagePtr opened this issue Sep 25, 2019 · 1 comment

Comments

@SagePtr
Copy link

SagePtr commented Sep 25, 2019

I have Intermediate config generated with https://ssl-config.mozilla.org/ (nginx 1.16.1, intermediate config, OpenSSL 1.0.2g):

ssl_protocols TLSv1.2;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off; 
(and other settings from generated config like session, stapling, dhparams, etc)

But it does not pass the test and i see purple question mark and "Non-compliant" level.
If i change ssl_prefer_server_ciphers on;, it passes the test and marks it as "Intermediate".

Does the https://observatory.mozilla.org/ TLS test contradict with https://ssl-config.mozilla.org/ recommendations?

Which ssl_prefer_server_ciphers should I actually use for Intermediate compatibility level - server preference or client preference?

@rwky
Copy link

rwky commented Nov 22, 2019

This also drops the grade to B.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants