Disable SSLv3 on Nginx

Question

Why on my server still enabled SSLv3 ? I want to disable for reasons that in some computers can not open my page because of safety issues.

I found this guide:

---

---

But currently I've got it set. My server is hosted in Google Cloud, I currently have this Nginx configuration file:

...
ssl on;
ssl_certificate /etc/nginx/dba_certs/dba_ssl2/ssl-bundle.crt;
ssl_certificate_key /etc/nginx/dba_certs/dba_keys/dba.key;

ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
ssl_prefer_server_ciphers on;
...

OpenSSL version is 1.0.1f 6 Jan 2014.

What could be wrong?

Bistro

have you restarted nginx? – Walkover

Yes. Even that configuration was when I installed my certificates. This only happens on some computers, for example in my computer the page opens normally. – Bistro

I do not think there is a connection between the error you get from the computers and sslv3, POODLE aware browsers does not handshake with sslv3. You may get certificate untrusted error because you may not have CA's intermediate certificate in your ssl-bundle.crt. Do you? – Walkover

@BurakTamtürk I followed this guide. I combined the 4 certificates files. – Bistro

Browsers aware the POODLE attack just does not prefer to handshake on SSL3, in case they should handshake on TLS, they should not give an error since they're patched to not handshake on SSL3, and the rest unaware browsers can't complain too, because they don't know about POODLE. You may start looking elsewhere for the problem, your certificate might be signed with SHA1, which chrome shows yellow sign or you might load images, css, or fonts from http, which some browsers may refuse to download the content. You might try to open a new question for the error you get from some browsers. Good luck – Walkover

Which SSL Checker did you use? – Grimm

Do you have OpenSSL 1.0.1+ ? – Wilburnwilburt

OpenSSL 1.0.1f 6 Jan 2014. I used this checker. You can see some issues?. In that case, what step I follow? – Bistro

Is Nginx reading the right configuration files? You may want to disable SSL to see whether HTTPS is still working (if it is still working, then it's the wrong file) – Amortize

Could you please try and show a minimal non-working nginx configuration? Which OS is running? – Grimm

Answer 1

To disable SSLv3, you'll have to edit default server configuration, not just an arbitrary virtual host config. It can only be disabled for a listen socket, not just a virtual server. The configuration snippet you've provided suggests that you are using per-server included configuration files, so you'll have to find one with default_server in the appropriate listen directive, and disable SSLv3 there:

server {
    listen 443 default_server ssl;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ...
}

Or, better yet, edit the configuration at http level, in nginx.conf:

http {
    ...
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ...
}

You may also consider upgrading nginx to a recent version. In nginx 1.9.1+ SSLv3 is disabled by default.

Pigment

The second method is cleaner, it has now been deactivated. While I'm thinking of upgrading Nginx, but I do not because I doubt that something will not work. Thank You. – Bistro

Answer 2

I can confirm that SSL3 is enabled. To disable, you need to modify either the NGINX configuration (nginx.conf) or the VirtualHost configuration file. In your case it is probably the following file:

$ sudo vim /etc/nginx/sites-enabled/dragonboundaimbot.com

        ...
        listen 443 default_server ssl;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ...

$ sudo service nginx restart

SSL3 is not the only problem though. Some of the cypher suites are depreciated and should not be used. Try to reduce the cypher-suites to the following:

TLS_RSA_WITH_AES_256_CBC_SHA256 (0x3d)  256
TLS_RSA_WITH_AES_256_CBC_SHA (0x35)     256
TLS_RSA_WITH_AES_128_CBC_SHA256 (0x3c)  128
TLS_RSA_WITH_AES_128_CBC_SHA (0x2f)     128
TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa)     112
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)   ECDH 256 bits (eq. 3072 bits RSA)   FS     256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)   ECDH 256 bits (eq. 3072 bits RSA)   FS    256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)   ECDH 256 bits (eq. 3072 bits RSA)   FS     128
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)   ECDH 256 bits (eq. 3072 bits RSA)   FS    128
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (0xc012)   ECDH 256 bits (eq. 3072 bits RSA)   FS   112

For other improvements, check e.g. the website with the Chrome browser and/or run an additional test on ssllabs.com.

Crofter

We don't even know what configuration files are in use and what's in them. – Grimm

I suggest to get in touch with a technician of the ISP that is hosting the site. – Crofter

I appreciate your answer, but I realized that the solution was written before on the other response. Thank you very much anyway. – Bistro

@wZVanG The other answer by maxim-dounin has been read two days after that one. – Grimm

@sebix, I only improved it slightly to make it the answer better to understand. – Crofter

Answer 3

I have created a gist for the steps to be followed to get a A rating in Qualys SSL test. And steps to disable SSLv3 and enable TSLv1 in proper way

Add SSL ciphers :

ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';

Fix OpenSSL Padding Oracle vulnerability :

https://gist.github.com/ArturT/bc8836d3bedff801dc324ac959050d12

ADD SSL protocols:

ssl_protocols TLSv1.2 TLSv1.1 TLSv1;

Set Preferred ciphers on:

ssl_prefer_server_ciphers on;

in the server block we should enable TCP v6 and v4 support

listen 443 ssl;

listen [::]:443 ssl;

add default_server in the above block

listen 443 default_server ssl;

listen [::]:443 default_server ssl;

Or Read here :

https://gist.github.com/kaushikgandhi/663e6e47d8a42025e848e454f5e064c4

Uniformed