Hacker News Reader

Comment by petecooper | Hacker News Reader

If you want Nginx to use TLS v1.2, this is what you need:

  ssl_protocols TLSv1.2;

…and if you compile a recent Nginx from source and bake in OpenSSL 1.1.1 while you do that, you can have TLS v1.3 with a TLS v1.2 fallback, too:

  ssl_protocols TLSv1.3 TLSv1.2;

See also:

https://caniuse.com/#feat=tls1-2

https://caniuse.com/#feat=tls1-3

View on HN

This is a bad design by nginx, how many people configuring a web server are thinking to themselves "I better check which version of OpenSSL I compiled with in order to set the appropriate TLS versions?". I'd guess approximately none.

The correct design would be something like:

  tls_minimum_version 1.2;

If they feel a compulsion to do so they could add a maximum version, but with a default of (none) and an explicit warning that this probably isn't what you wanted to change.

tls 1.3 is still very new, so it makes sense that it would have both compile time and runtime concerns. Unless you are specifically trying to use tls 1.3 (which isn't most people), you don't need to turn it on, even if it is compiled in. Of course if you are specifically trying to use it, you probably know how you compiled nginx. So really it isn't bad design at all.

I reported this four years ago with a patch at https://trac.nginx.org/nginx/ticket/642. Nobody seems to have noticed.

These links work with JS disabled:

https://caniuse.com/tls1-2

https://caniuse.com/tls1-3

The default includes TLSv1.2 (along with TLSv1.1 and TLSv1). So the default does and will continue to use TLSv1.2 with browsers that support it, and will still work when browsers disable TLSv1 and TLSv1.1

https://caniuse.com itself only supports TLS 1.0. They know about it https://github.com/Fyrd/caniuse/issues/4198

Reply on news.ycombinator.com