Could someone suggest an optimal ssl cipher configuration for my nginx server that supports both CloudFlare and CloudFront? I have tried a few of the suggestions in other threads, but CloudFront returns errors.

Update 1:

The relevant content from my current nginx conf is below. I have tried a variety of cipher configurations from other threads on StackExchange but have had little luck. The current one is copied from the Mozilla Wiki, but I'm happy to change to try other configurations that you all might suggest. The error I am seeing is "ERROR The request could not be satisfied. Generated by cloudfront (CloudFront)" Click here for an example. Any other suggestions are greatly appreciated!

server {
    listen 443;
    server_name collin-barrett.com;

    ssl on;
    ssl_session_timeout 5m;
    ssl_session_cache shared:SSL:50m;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;

    add_header Strict-Transport-Security max-age=15768000;
  • Could you update your question with what errors CloudFrong is returning?
    – RoraΖ
    Commented Oct 12, 2014 at 13:33
  • @raz Thanks for responding. See my updated question under "Update 1". Commented Oct 12, 2014 at 19:53

3 Answers 3


I don't know about CloudFlare, but Amazon CloudFront's documentation lists the protocols and cipher suites they support. As of right now, that consists of SSL 3.0 and TLS 1.0, and these common cipher suites (and RC4):


I would guess that a similar configuration would also work for CloudFlare.

I second raz's question about what error message you receive.

Update 1:

I have a couple thoughts in response to your "Update 1":

First, I notice that your config sample doesn't include anything about a certificate. Huh?

Second, https://collin-barrett.com/ is behind CloudFlare. Are you having CloudFront connect to CloudFlare, or is CloudFront connecting to your real web server via some other hostname? This raises several potential issues. Among others I've probably missed:

  • Double-check this, but I think CloudFlare Universal SSL may only support ECDSA certificates. CloudFront's client apparently only supports RSA certificates. This would be a problem.

  • If you do have CloudFront connecting to another vhost, I'd like to see its config.

  • If it's connecting to that vhost via another non-CloudFlare hostname (backend.collin-barrett.com or somesuch), I could envision mismatches in the hostname configured in your certificate, or your vhost, or CloudFront.

  • Why use both CloudFlare and CloudFront? CloudFlare is a CDN already. It's redundant.

Now, I have to go. Good luck.

  • thanks for responding. I have seen those ciphers in the AWS documentation and from what I can tell my current config should be working. But it's not. See my updated question under "Update 1". Thanks! Commented Oct 12, 2014 at 19:55
  • 1
    Well, I had always used CloudFront in conjunction with CloudFlare becasue CloudFront's CDN was better from my research. At this point, though, CloudFlare is likely just as good. Your point about Universal SSL only supporting ECDSA is the solution that makes sense. I downgraded to a CloudFlare free account as soon as Universal SSL launched and that is when the CloudFront issues started occurring. For now, I'll probably just discontinue using CloudFront. Thanks for your help! Commented Oct 12, 2014 at 22:16
  • > "CloudFront ... As of right now, that consists of SSL 3.0 and TLS 1.0" ... really? Commented Oct 13, 2014 at 7:06

i found the recommendet cipher-suites form ssllabs and mozilla working in nearly any conditions, more infos here: Guide to Nginx + SSL + SPDY

regarding the mozilla-suggestions, please read this guide: Security/Server Side TLS; it explains the differences between modern/intermediate/old backward - cipher-suites

for the record:

# suggestion from sslabs / including PFS, good compatibility

# suggestion from mozilla, intermediate suggestion, best compatibility

  • thanks for the response, @that guy from over there, I have tried both of these cipher suites, though, with no luck. see my updated question under "Update 1". Commented Oct 12, 2014 at 19:54

Well there is some update I had to do myself to my website so I changed all old ciphers as well as the protocols support:

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

As you can see SSLv3 is no longer there due to POODLE Vulnerability.

New ciphers:


You can test that if you like at SSLLabs to see your SSL score.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .