4 ms·

If you want Nginx to use TLS v1.2, this is what you need: ssl_protocols TLSv1.2; …and if you compile a recent Nginx from source and bake in OpenSSL 1.1.1 wh

If you want Nginx to use TLS v1.2, this is what you need: ssl_protocols TLSv1.2; …and if you compile a recent Nginx from source and bake in OpenSSL 1.1.1 while you do that, you can have TLS v1.3 with a TLS v1.2 fallback, too: ssl_protocols TLSv1.3 TLSv1.2; See also: https://caniuse.com/#feat=tls1-2 https://caniuse.com/#feat=tls1-2 https://caniuse.com/#feat=tls1-3 https://caniuse.com/#feat=tls1-3

tialaramex 8y ago
This is a bad design by nginx, how many people configuring a web server are thinking to themselves "I better check which version of OpenSSL I compiled with in order to set the appropriate TLS versions?". I'd guess approximately none. The correct design would be something like: tls_minimum_version 1.2; If they feel a compulsion to do so they could add a maximum version, but with a default of (none) and an explicit warning that this probably isn't what you wanted to change.
- benchaney 8y ago
  tls 1.3 is still very new, so it makes sense that it would have both compile time and runtime concerns. Unless you are specifically trying to use tls 1.3 (which isn't most people), you don't need to turn it on, even if it is compiled in. Of course if you are specifically trying to use it, you probably know how you compiled nginx. So really it isn't bad design at all.
- anderskaseorg 8y ago
  I reported this four years ago with a patch at https://trac.nginx.org/nginx/ticket/642 https://trac.nginx.org/nginx/ticket/642. Nobody seems to have noticed.
ploxiln 8y ago
The default includes TLSv1.2 (along with TLSv1.1 and TLSv1). So the default does and will continue to use TLSv1.2 with browsers that support it, and will still work when browsers disable TLSv1 and TLSv1.1
jwilk 8y ago
These links work with JS disabled: https://caniuse.com/tls1-2 https://caniuse.com/tls1-2 https://caniuse.com/tls1-3 https://caniuse.com/tls1-3
sdeziel 8y ago
https://caniuse.com https://caniuse.com itself only supports TLS 1.0. They know about it https://github.com/Fyrd/caniuse/issues/4198 https://github.com/Fyrd/caniuse/issues/4198

tialaramex 8y ago

This is a bad design by nginx, how many people configuring a web server are thinking to themselves "I better check which version of OpenSSL I compiled with in order to set the appropriate TLS versions?". I'd guess approximately none. The correct design would be something like: tls_minimum_version 1.2; If they feel a compulsion to do so they could add a maximum version, but with a default of (none) and an explicit warning that this probably isn't what you wanted to change.

benchaney 8y ago
tls 1.3 is still very new, so it makes sense that it would have both compile time and runtime concerns. Unless you are specifically trying to use tls 1.3 (which isn't most people), you don't need to turn it on, even if it is compiled in. Of course if you are specifically trying to use it, you probably know how you compiled nginx. So really it isn't bad design at all.
anderskaseorg 8y ago
I reported this four years ago with a patch at https://trac.nginx.org/nginx/ticket/642 https://trac.nginx.org/nginx/ticket/642. Nobody seems to have noticed.

ploxiln 8y ago

The default includes TLSv1.2 (along with TLSv1.1 and TLSv1). So the default does and will continue to use TLSv1.2 with browsers that support it, and will still work when browsers disable TLSv1 and TLSv1.1

jwilk 8y ago

These links work with JS disabled: https://caniuse.com/tls1-2 https://caniuse.com/tls1-2 https://caniuse.com/tls1-3 https://caniuse.com/tls1-3

sdeziel 8y ago

https://caniuse.com https://caniuse.com itself only supports TLS 1.0. They know about it https://github.com/Fyrd/caniuse/issues/4198 https://github.com/Fyrd/caniuse/issues/4198