Server negotiated HTTP/2 with blacklisted suite

Question

I understand there are quite a few posts regarding my error message, and I have looked at them with no luck to resolving my own issue.

Essentially, certain web browsers are unable to load my site because of the following blacklisted suites

Server negotiated HTTP/2 with blacklisted suite

TLS_RSA_WITH_AES_256_CBC_SHA

TLS_RSA_WITH_AES_256_GCM_SHA384

My Nginx configurations contain the following

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!DH:!ECDH:!CAMELLIA:!SRP:!PSK:!MD5:!KRB5;

What needs to be changed in my ssl_ciphers? Or, what resources can I look into that will give me a direction?

Answer 1

These suits included in the list of ciphersuites prohibited by HTTP/2 defined in RFC 7540.

Since AES-GCM and RSA still enjoy a good reputation, the remaining weakness of the second suite is that it doesn't offer forward-secrecy.

The specification confirms this:

This list includes those cipher suites that do not offer an ephemeral key exchange [this rules out both of your suites] and those that are based on the TLS null, stream, or block cipher type [this rules out TLS_RSA_WITH_AES_256_CBC_SHA]

In your config string I see !DH and more importantly !ECDH which disables all kinds of Diffie-Hellman suites, including ephemeral Diffie-Hellman, which are the way SSL achieves forward secrecy.

ECDH

cipher suites using ECDH key exchange, including anonymous, ephemeral and fixed ECDH.

Thus the fix is to allow ephemeral elliptic curve Diffie-Hellman (ECDHE)