3

In my Nginx config I have:

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;     
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;

But on Chrome cert icon, I still get the "Your connection to website is encrypted with obsolete cryptography" message. Any suggestions on what to do to get rid of this message?

Improve this question
6
  • There are lots of questions on this here. Have a search and see if another's question has your answer.
    – schroeder ♦
    Jul 10, 2015 at 22:40
  • Change your crypto?
    – Slava Knyazev
    Jul 10, 2015 at 23:11
  • I did.... I've pasted all the recommended ssl_ciphers directive, bounced nginx, and still no success.
    – dman
    Jul 11, 2015 at 0:50
  • Try the config from the Mozilla SSL config generator.
    – tlng05
    Jul 11, 2015 at 2:53
  • 3
    Details! What clients? Screenshot! What SSL Labs test result? (Screenshot) What domain name?
    – StackzOfZtuff
    Jul 11, 2015 at 12:30

1 Answer 1

Reset to default
3

These ciphers are old:

DHE-DSS-AES128-GCM-SHA256:DHE-DSS-AES256-GCM-SHA384:DHE-DSS-AES128-SHA256:DHE-DSS-AES256-SHA:SRP-DSS-AES-256-CBC-SHA:SRP-RSA-AES-256-CBC-SHA:SRP-AES-256-CBC-SHA:DHE-DSS-AES256-SHA256:SRP-DSS-AES-128-CBC-SHA:SRP-RSA-AES-128-CBC-SHA:SRP-AES-128-CBC-SHA:DHE-DSS-AES128-SHA:DHE-DSS-CAMELLIA256-SHA:CAMELLIA256-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-DSS-CAMELLIA128-SHA

The fastest way to get rid of them is to append to ciphersuite this:

!EDH-DSS:!SRP

Also, do not forget to define your own DH parameters or all connections with DHE- ciphers are weak!

If you want to have very good security, you can use this cipher suite, as it is:

EECDH+ECDSA+AESGCM:EECDH+ECDSA+AES256:EECDH+ECDSA+AES:EECDH+AESGCM:EECDH+AES256:EECDH+AES:EDH+AESGCM:EDH+AES256:EDH+AES:EECDH+ECDSA+3DES:EECDH+3DES:EDH+3DES:RSA+AESGCM:RSA+AES256:RSA+AES:RSA+3DES:!NULL:!RC4:!EDH+DSS:!MD5
Improve this answer
4
  • "do not forget to define your own DH parameters or all DHE- ciphers are weak" - No, the ciphers are not weak. The use of shared ECDH groups is potentially problematic, and steps should be taken to generate your own parameters, but that doesn't make the cipher weak.
    – Polynomial
    Jul 13, 2015 at 10:47
  • OK, fixed to be more accurate.
    – Vilican
    Jul 13, 2015 at 11:15
  • @Polynomial: s/shared ECDH groups/shared DH groups/ ? Or s/shared ECDH groups/named ECDH curves/ ?
    – StackzOfZtuff
    Jul 13, 2015 at 12:32
  • @StackzOfZtuff Sorry, I conflated the two.
    – Polynomial
    Jul 13, 2015 at 12:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .