# Make ssl\_certificate optional?

**URL:** <https://www.ruby-forum.com/t/make-ssl-certificate-optional/201316>\
**Category:** NGINX\
**Created:** [January 5, 2011, 7:44am UTC](https://www.ruby-forum.com/t/make-ssl-certificate-optional/201316 "2011-01-05T07:44:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\
**Post date:** [January 5, 2011, 7:44am UTC](https://www.ruby-forum.com/t/make-ssl-certificate-optional/201316/1 "2011-01-05T07:44:34Z")

</div>

Is there any possibility of allowing the use of SSL without the  
ssl\_certificate option in nginx?

Before you say I’m crazy, hear me out. I want to operate servers where  
security is not required (the same content is served over HTTP) but it  
would be nice to offer some encryption for people who desire it. I also  
very strongly do not want to bother with certificates, especially as  
those certificates would be self-signed and consequently offer _zero_  
extra security assurance over anonymous DH mode.

The nginx config I _want_ looks something like this:

http {  
server {  
listen 443;  
ssl on;  
ssl\_ciphers ADH:aNULL:eNULL;  
}  
}

I would happily settle for:

http {  
server {  
listen 443;  
ssl on;  
ssl\_ciphers ADH:aNULL:eNULL;  
ssl\_without\_certificate\_because\_im\_crazy on;  
}  
}

Right now, I have to use:

http {  
server {  
listen 443;  
ssl on;  
ssl\_ciphers ADH:aNULL:eNULL;  
ssl\_certificate /some/x509/cert/which/will/never/be/used.pem;  
ssl\_certificate\_key /some/x509/cert/which/will/never/be/used.pem;  
}  
}

I can’t even use /dev/null because nginx croaks on an invalid  
certificate.

It’s a minor grief, certainly, but there really are perfectly valid SSL  
modes that don’t involve a certificate on the server side and I’m hoping  
to avoid having to create snakeoil certs for all of my servers.

–  
-Julian Blake K. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
If this is a mailing list, please CC me on replies.

vim: set ft=text :

---

<div class="post-metadata">

**Author:** ![Julian\_Blake\_K](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/ccd318/32.png) [@Julian\_Blake\_K](https://www.ruby-forum.com/u/Julian_Blake_K)\
**Post date:** [January 5, 2011, 10:49am UTC](https://www.ruby-forum.com/t/make-ssl-certificate-optional/201316/2 "2011-01-05T10:49:36Z")

</div>

> Is there any possibility of allowing the use of SSL without the  
> ssl\_certificate option in nginx?

Your crazy.

> Before you say I’m crazy,

Never mind…

> hear me out. I want to operate servers where  
> security is not required (the same content is served over HTTP) but it  
> would be nice to offer some encryption for people who desire it. I also  
> very strongly do not want to bother with certificates, especially as  
> those certificates would be self-signed and consequently offer _zero_  
> extra security assurance over anonymous DH mode.

The question you should ask: is any client other than openssl actually  
capable of connecting successfully to such a server?

IIRC, Firefox disabled all the “insecure” SSL-ciphers some time ago  
anyway…

Rainer

---

<div class="post-metadata">

**Author:** ![Julian\_Blake\_K](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/ccd318/32.png) [@Julian\_Blake\_K](https://www.ruby-forum.com/u/Julian_Blake_K)\
**Post date:** [January 5, 2011, 3:51pm UTC](https://www.ruby-forum.com/t/make-ssl-certificate-optional/201316/3 "2011-01-05T15:51:06Z")

</div>

On Wed, Jan 05, 2011 at 10:48:33AM +0100, [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> The question you should ask: is any client other than openssl actually  
> capable of connecting successfully to such a server?
> 
> IIRC, Firefox disabled all the “insecure” SSL-ciphers some time ago anyway…

Firefox gives an error on connection, but some other browsers connect  
just fine; the nginx configuration with a useless certificate works just  
fine in practice for my purposes, it’s just not as easy to setup and  
deploy. For what it’s worth, the most common clients for these sites by  
volume are all libcurl, which works just fine as long as you set the  
don’t-verify-peer bits.

We have some patches queued up to send to a few more mainstream  
browsers that enable ADH and NULL ciphers such that the lock icons are  
not displayed and the URL bar is not colored, leaving the user  
experience exactly the same as if no SSL was involved at all, which  
seems like a politically acceptable compromise for getting ADH support  
back into Firefox et al.

Unfortunately, browsers are complicated and testing all the pathways  
involved in treating a SSL connection as an insecure connection is not  
trivial, so I’m tilting at your windmill first and will be fighting  
those other battles another day.

> Rainer

Thanks,

–  
-Julian Blake K. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
If this is a mailing list, please CC me on replies.

vim: set ft=text :