thib8956/nginx-proxy
1
0
Fork 0
mirror of https://github.com/thib8956/nginx-proxy synced 2025-02-24 09:48:14 +00:00
Code Issues Releases Wiki Activity

fix: enforce TLSv1.3 on Mozilla-Modern SSL policy

Browse Source
This commit is contained in:
Nicolas Duchon 2023-12-08 22:41:29 +01:00
parent c6868ed6be
commit 4c556290f9
No known key found for this signature in database
GPG Key ID: EA3151C66A4D79E7
1 changed files with 10 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
nginx.tmpl
View File

@ -142,15 +142,12 @@
{{- define "ssl_policy" }} {{- define "ssl_policy" }}
{{- if eq .ssl_policy "Mozilla-Modern" }} {{- if eq .ssl_policy "Mozilla-Modern" }}
ssl_protocols TLSv1.3; ssl_protocols TLSv1.3;
{{- /* {{- /*
* nginx currently lacks ability to choose ciphers in TLS 1.3 in * This ssl_ciphers directive is not used but necessary to get TLSv1.3 only.
* configuration, see https://trac.nginx.org/nginx/ticket/1529. * see https://serverfault.com/questions/1023766/nginx-with-only-tls1-3-cipher-suites
* A possible workaround can be modify /etc/ssl/openssl.cnf to change */}}
* it globally (see https://trac.nginx.org/nginx/ticket/1529#comment:12). ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384;
* Explicitly set nginx default value in order to allow single servers ssl_conf_command Ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256;
* to override the global http value.
*/}}
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers off; ssl_prefer_server_ciphers off;
{{- else if eq .ssl_policy "Mozilla-Intermediate" }} {{- else if eq .ssl_policy "Mozilla-Intermediate" }}
ssl_protocols TLSv1.2 TLSv1.3; ssl_protocols TLSv1.2 TLSv1.3;
@ -162,6 +159,10 @@
ssl_prefer_server_ciphers on; ssl_prefer_server_ciphers on;
{{- else if eq .ssl_policy "AWS-TLS13-1-3-2021-06" }} {{- else if eq .ssl_policy "AWS-TLS13-1-3-2021-06" }}
ssl_protocols TLSv1.3; ssl_protocols TLSv1.3;
{{- /*
* This ssl_ciphers directive is not used but necessary to get TLSv1.3 only.
* see https://serverfault.com/questions/1023766/nginx-with-only-tls1-3-cipher-suites
*/}}
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384; ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384;
ssl_conf_command Ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256; ssl_conf_command Ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256;
ssl_prefer_server_ciphers on; ssl_prefer_server_ciphers on;