the nginx centos 6 RPM is linked against openssl 0.9.8 AND
when using a source build, you didn’t stop and start the correct executable
AND/OR
you have some library mismatch/mess on your system
If you don’t care about the possible mess on your system and want a fast fix,
just build it statically, as previously suggested.
hi lukas, hi mex,
there is definetely something strange – this is a vanilla install –
for testing – i installed apache on the same machine and ran it on port
444 for an ssl host. it works as expected. that would seem to indicate
the ssl libraries, etc, are in good shape.
if you point a mozilla firefox 32.0.3 to this site, you get:
Secure Connection Failed
An error occurred during a connection to domain.com. SSL peer selected a cipher
suite disallowed for the selected protocol version. (Error code:
ssl_error_cipher_disallowed_for_version)
The page you are trying to view cannot be shown because the authenticity of
the received data could not be verified.
Please contact the website owners to inform them of this problem.
i am going to generate some different certs – mine are insane – 4096
key, 4096 dh, sha512 sig – perhaps the problem lies there. although,
why would apache work and not nginx?
Please contact the website owners to inform them of this problem.
i am going to generate some different certs – mine are insane – 4096 key,
4096 dh, sha512 sig – perhaps the problem lies there. although, why would apache
work and not nginx?
will report back tomorrow.
thanks!
m
I find that SSL Server Test (Powered by Qualys SSL Labs) provides a good breakdown
of what a site is offering. I certainly used it to fine tune my SSL
setup. I generally use CentOS 6/Amazon, but do use the nginx repo when
not building from source for pagespeed. This repo certainly offers all
the way up to TLS 1.2 if enabled.
Judging from a recent discussion on the IETF TLS list [1], there seems
to be some confusion over whether the TLS signature_algorithms extension
should 1) restrict the permitted certificate signature algorithms and
the non-certificate uses of digital signatures in the TLS protocol or 2)
only restrict the non-certificate uses of digital signatures in the TLS
protocol.
Those taking view 2 don’t offer SHA512/RSA because no cipher suites
require it. I’ve concluded that, sadly, certs signed with SHA512/RSA
basically don’t work for TLS.
Judging from a recent discussion on the IETF TLS list [1], there seems to be
some confusion over whether the TLS signature_algorithms extension should 1)
restrict the permitted certificate signature algorithms and the non-certificate
uses of digital signatures in the TLS protocol or 2) only restrict the
non-certificate uses of digital signatures in the TLS protocol.
Those taking view 2 don’t offer SHA512/RSA because no cipher suites require it.
I’ve concluded that, sadly, certs signed with SHA512/RSA basically don’t work for
TLS.
the offer was checked using openssl binary command within the https://testssl.sh/testssl.sh script – the openssl binary is
openssl-1.0.2-beta1
i agree – nginx cannot handle an sha512 signed cert and will only offer
sslv3. apache does offer tlsv1.* with an sha512 signature. this question
goes beyond my comprehension of ssl, so i am going to live with sha256
– strong enough to quench my paranoiac thirst
