All:
I have the following version of Nginx installed and supports TLSv1.2 and TLSv1.3.
# /opt/sbin/nginx -V
nginx version: nginx/1.19.2 (x86_64-pc-linux-gnu)
built with OpenSSL 1.1.1g 21 Apr 2020
TLS SNI support enabled
Additionally, by default, it also appears that TLSv1.0 and TLSv1.1 are supported and enabled.
# openssl s_client -tls1 -connect xxx.xxx.xxx.xx:443
CONNECTED(00000003)
depth=0 CN = www.z7bm7ektzllnsh.net
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = www.z7bm7ektzllnsh.net
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
0 s:/CN=www.z7bm7ektzllnsh.net
i:/CN=www.u4g2dxzlesntdm26vmd.com
---
Server certificate
-----BEGIN CERTIFICATE-----
MIICRjCCAa+gAwIBAgIIOoJpYk/2Z/QwDQYJKoZIhvcNAQELBQAwJjEkMCIGA1UE
Awwbd3d3LnU0ZzJkeHpsZXNudGRtMjZ2bWQuY29tMB4XDTIxMDcxNjAwMDAwMFoX
DTIyMDIwODIzNTk1OVowITEfMB0GA1UEAwwWd3d3Lno3Ym03ZWt0emxsbnNoLm5l
dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM9iGBTOVMi++QpMhsYM
GZzRJBTxXzCADz82DSZCiXCW6wMYJ9TPKWUo9awqqLUYW5MfIzTRfhPxndPJsEG1
hMISh4NEQ1FnmUlJx3MvR34j9esTWeA6wHacN92T76d+gXshHHLRZZ0prKpzBCZK
F98EmnZAH40EvG/+hBWjgkA0tWhvNFcxqTdUqEUd69ES+m6L08hQdlzKetWfwPwg
2oe2ZlLExAOZbai/D+zyWC/06PcsSUBueiDtnJ75TDZwejzc12REbLCurMHs2U3w
NBqyCV43HI4kH1NQAMbyumWO7wNOVDI/qrfnR8/g+HeGk/arM1pwVDdxVWi/8dja
OCcCAwEAATANBgkqhkiG9w0BAQsFAAOBgQCuO8JWDQiZcHA+LfaReL5KinVUyo+v
4J5X81pgvRNGrHkmuqHz6RHXLIP9KqmkFWwccP2JpUulGqYbbBzjaKRGcBRsuW5y
H87ZSuVzQ2fz6jOBbRCiiBYDeXoOjFhL8XFxWS9JSZ2Yn7LuTaUsnq4OxKhxFj/P
9R6hwOPwjbXbwQ==
-----END CERTIFICATE-----
subject=/CN=www.z7bm7ektzllnsh.net
issuer=/CN=www.u4g2dxzlesntdm26vmd.com
---
No client certificate CA names sent
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 1067 bytes and written 328 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1
Cipher : ECDHE-RSA-AES256-SHA
Session-ID:
Session-ID-ctx:
Master-Key: D128399FE72DB5512783E15015D4869762748D40C04DD273E5B179A0A330FB56246ABBFC8162A5B126CB27EBDA74469C
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1629349779
Timeout : 7200 (sec)
Verify return code: 21 (unable to verify the first certificate)
---
An application that I have successfully installed and running only accepts TLSv1.2 and TLSv1.3 connections and is able to renegotiate TLSv1.0 connections to TLSv1.2 or TLSv1.3 on its own.
However, when I attempt to place Nginx in front of to TCP Stream the aforementioned application, according to packet-traces, Nginx simply resets the TLSv1.0 connections and does not attempt to renegotiate them to TLSv1.2 or TLSv1.3.
I have reduced my nginx.conf file to only include the stream block in question:
# cat nginx.conf
user nobody;
worker_processes auto;
worker_rlimit_nofile 7168;
events {
worker_connections 3584;
}
stream {
upstream application {
hash $remote_addr consistent;
server 192.168.0.21:8443 weight=4 max_fails=1 fail_timeout=10s;
}
server {
listen xxx.xxx.xxx.xxx:443;
#proxy_bind $server_addr;
proxy_pass application;
#proxy_buffer_size 16k;
#proxy_connect_timeout 1s;
#proxy_timeout 3s;
#health_check;
#health_check_timeout 5s;
}
}
Within the Nginx server block, I attempted to force Nginx to only use the TLSv1.2 protocol:
ssl_protocols TLSv1.2;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;
However, it appears that all the TLS protocols were still available:
# openssl s_client -tls1 -connect xxx.xxx.xxx.xxx:443
CONNECTED(00000003)
depth=0 CN = www.z7bm7ektzllnsh.net
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = www.z7bm7ektzllnsh.net
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
0 s:/CN=www.z7bm7ektzllnsh.net
i:/CN=www.u4g2dxzlesntdm26vmd.com
---
Server certificate
-----BEGIN CERTIFICATE-----
MIICRjCCAa+gAwIBAgIIOoJpYk/2Z/QwDQYJKoZIhvcNAQELBQAwJjEkMCIGA1UE
Awwbd3d3LnU0ZzJkeHpsZXNudGRtMjZ2bWQuY29tMB4XDTIxMDcxNjAwMDAwMFoX
DTIyMDIwODIzNTk1OVowITEfMB0GA1UEAwwWd3d3Lno3Ym03ZWt0emxsbnNoLm5l
dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM9iGBTOVMi++QpMhsYM
GZzRJBTxXzCADz82DSZCiXCW6wMYJ9TPKWUo9awqqLUYW5MfIzTRfhPxndPJsEG1
hMISh4NEQ1FnmUlJx3MvR34j9esTWeA6wHacN92T76d+gXshHHLRZZ0prKpzBCZK
F98EmnZAH40EvG/+hBWjgkA0tWhvNFcxqTdUqEUd69ES+m6L08hQdlzKetWfwPwg
2oe2ZlLExAOZbai/D+zyWC/06PcsSUBueiDtnJ75TDZwejzc12REbLCurMHs2U3w
NBqyCV43HI4kH1NQAMbyumWO7wNOVDI/qrfnR8/g+HeGk/arM1pwVDdxVWi/8dja
OCcCAwEAATANBgkqhkiG9w0BAQsFAAOBgQCuO8JWDQiZcHA+LfaReL5KinVUyo+v
4J5X81pgvRNGrHkmuqHz6RHXLIP9KqmkFWwccP2JpUulGqYbbBzjaKRGcBRsuW5y
H87ZSuVzQ2fz6jOBbRCiiBYDeXoOjFhL8XFxWS9JSZ2Yn7LuTaUsnq4OxKhxFj/P
9R6hwOPwjbXbwQ==
-----END CERTIFICATE-----
subject=/CN=www.z7bm7ektzllnsh.net
issuer=/CN=www.u4g2dxzlesntdm26vmd.com
---
No client certificate CA names sent
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 1067 bytes and written 328 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1
Cipher : ECDHE-RSA-AES256-SHA
Session-ID:
Session-ID-ctx:
Master-Key: 40DF5E33387B92F1B2B132CC8DD09492CC9B37757B0B16073EC36DB9EACE34242A53D88F419CF40FBF4A8263EC524BA1
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1629350998
Timeout : 7200 (sec)
Verify return code: 21 (unable to verify the first certificate)
---
Why is Nginx resetting TLSv1.0 connections and not asking them to renegotiate to TLSv1.2 or TLSv1.3 like the application?
Why are my ssl_protocols changes not taking effect within Nginx to include and/or exclude the protocols specified?
Your assistance is greatly appreciated.
Respectfully,
Gary