# TLS 1.2 ciphers

**URL:** <https://www.ruby-forum.com/t/tls-1-2-ciphers/246069>\
**Category:** NGINX\
**Created:** [August 21, 2013, 7:19pm UTC](https://www.ruby-forum.com/t/tls-1-2-ciphers/246069 "2013-08-21T19:19:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sadaf\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/858c86/32.png) [@Sadaf\_N](https://www.ruby-forum.com/u/Sadaf_N)\
**Post date:** [August 21, 2013, 7:19pm UTC](https://www.ruby-forum.com/t/tls-1-2-ciphers/246069/1 "2013-08-21T19:19:45Z")

</div>

Chrome 29 came out recently and now supports TLS 1.2. So i decided to  
add  
some of the new TLS 1.2 ciphers to my webserver, which are specified  
here:  
[/docs/manmaster/man1/ciphers.html](https://www.openssl.org/docs/apps/ciphers.html#TLS_v1_2_cipher_suites).

My current setup is: Ubuntu 10.04, Nginx 1.5.3 ,OpenSSL 1.0.1e (build  
myself)  
Config file:

server {  
listen 80;  
server\_name [sherbers.de](http://sherbers.de);  
return 301 https://$server\_name$request\_uri;  
}  
server {  
listen 443 ssl spdy default\_server;  
server\_name [sherbers.de](http://sherbers.de);

```
ssl_certificate /etc/ssl/private/hosteurope/www.sherbers.de.pem;
ssl_certificate_key /etc/ssl/private/hosteurope/www.sherbers.de.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers

```

ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA;  
ssl\_prefer\_server\_ciphers on;  
ssl\_session\_cache shared:SSL:10m;

As you can see i only use ciphers with perfect forward secrecy, because  
why  
not. When i connect to my webserver chrome shows it is using TLS 1.2 but  
as  
a cipher it using ECDHE-RSA, which it was using before too when i only  
offered TLS 1.1, without any of the ECDHE-ECDSA ciphers.

Any idea why nginx doesn’t offers the new cipers?

Additional information:

- An ssl check at [https://sslcheck.globalsign.com](https://sslcheck.globalsign.com) doesn’t list any of  
the  
ECDHE-ECDSA ciphers
- “openssl ciphers -v | grep ECDHE-ECDSA” outputs the following:  
ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA  
Enc=AESGCM(256)  
Mac=AEAD  
ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(256)  
Mac=SHA384  
ECDHE-ECDSA-AES256-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=AES(256)  
Mac=SHA1  
ECDHE-ECDSA-DES-CBC3-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=3DES(168)  
Mac=SHA1  
ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA  
Enc=AESGCM(128)  
Mac=AEAD  
ECDHE-ECDSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(128)  
Mac=SHA256  
ECDHE-ECDSA-AES128-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=AES(128)  
Mac=SHA1  
ECDHE-ECDSA-RC4-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=RC4(128)  
Mac=SHA1

Posted at Nginx Forum:

> **[TLS 1.2 ciphers](https://forum.nginx.org/read.php?2,242096,242096#msg-242096)**
>
> Chrome 29 came out recently and now supports TLS 1.2. So i decided to add some of the new TLS 1.2 ciphers to my webserver, which are specified here: https://www.openssl.org/docs/apps/ciphers.html#TLS\_v1\_2\_cipher\_suites. My current setup is: Ubuntu...

---

<div class="post-metadata">

**Author:** ![stephan13360](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/839c29/32.png) [@stephan13360](https://www.ruby-forum.com/u/stephan13360)\
**Post date:** [August 21, 2013, 8:00pm UTC](https://www.ruby-forum.com/t/tls-1-2-ciphers/246069/2 "2013-08-21T20:00:39Z")

</div>

Hello!

On Wed, Aug 21, 2013 at 01:19:01PM -0400, stephan13360 wrote:

> ```
> server_name sherbers.de;
> 
> ```

ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA;

> ```
> ssl_prefer_server_ciphers on;
> ssl_session_cache shared:SSL:10m;
> 
> ```
> 
> As you can see i only use ciphers with perfect forward secrecy, because why  
> not. When i connect to my webserver chrome shows it is using TLS 1.2 but as  
> a cipher it using ECDHE-RSA, which it was using before too when i only  
> offered TLS 1.1, without any of the ECDHE-ECDSA ciphers.
> 
> Any idea why nginx doesn’t offers the new cipers?

ECDSA ciphers need an ECDSA certificate to work. As your cert is  
RSA, it RSA ciphers are used.

–  
Maxim D.

> **[nginx: donation](http://nginx.org/en/donation.html)**

---

<div class="post-metadata">

**Author:** ![stephan13360](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/839c29/32.png) [@stephan13360](https://www.ruby-forum.com/u/stephan13360)\
**Post date:** [August 21, 2013, 8:08pm UTC](https://www.ruby-forum.com/t/tls-1-2-ciphers/246069/3 "2013-08-21T20:08:15Z")

</div>

Thanks. I never even considered that the certificate could be the  
problem.

## Maxim D. Wrote:

> > server {  
> > S256-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-S  
> > offered TLS 1.1, without any of the ECDHE-ECDSA ciphers.
> 
> * * *
> 
> nginx mailing list  
> [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
> [mailman.nginx.org archive](http://mailman.nginx.org/mailman/listinfo/nginx)

Posted at Nginx Forum:  
[http://forum.nginx.org/read.php?2,242096,242099#msg-242099](http://forum.nginx.org/read.php?2,242096,242099#msg-242099)