3

In my Nginx config I have:

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;     
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;

But on Chrome cert icon, I still get the "Your connection to website is encrypted with obsolete cryptography" message. Any suggestions on what to do to get rid of this message?

6
  • There are lots of questions on this here. Have a search and see if another's question has your answer.
    – schroeder
    Commented Jul 10, 2015 at 22:40
  • Change your crypto? Commented Jul 10, 2015 at 23:11
  • I did.... I've pasted all the recommended ssl_ciphers directive, bounced nginx, and still no success.
    – dman
    Commented Jul 11, 2015 at 0:50
  • Try the config from the Mozilla SSL config generator.
    – tlng05
    Commented Jul 11, 2015 at 2:53
  • 3
    Details! What clients? Screenshot! What SSL Labs test result? (Screenshot) What domain name? Commented Jul 11, 2015 at 12:30

1 Answer 1

3

These ciphers are old:

DHE-DSS-AES128-GCM-SHA256:DHE-DSS-AES256-GCM-SHA384:DHE-DSS-AES128-SHA256:DHE-DSS-AES256-SHA:SRP-DSS-AES-256-CBC-SHA:SRP-RSA-AES-256-CBC-SHA:SRP-AES-256-CBC-SHA:DHE-DSS-AES256-SHA256:SRP-DSS-AES-128-CBC-SHA:SRP-RSA-AES-128-CBC-SHA:SRP-AES-128-CBC-SHA:DHE-DSS-AES128-SHA:DHE-DSS-CAMELLIA256-SHA:CAMELLIA256-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-DSS-CAMELLIA128-SHA

The fastest way to get rid of them is to append to ciphersuite this:

!EDH-DSS:!SRP

Also, do not forget to define your own DH parameters or all connections with DHE- ciphers are weak!

If you want to have very good security, you can use this cipher suite, as it is:

EECDH+ECDSA+AESGCM:EECDH+ECDSA+AES256:EECDH+ECDSA+AES:EECDH+AESGCM:EECDH+AES256:EECDH+AES:EDH+AESGCM:EDH+AES256:EDH+AES:EECDH+ECDSA+3DES:EECDH+3DES:EDH+3DES:RSA+AESGCM:RSA+AES256:RSA+AES:RSA+3DES:!NULL:!RC4:!EDH+DSS:!MD5
4
  • "do not forget to define your own DH parameters or all DHE- ciphers are weak" - No, the ciphers are not weak. The use of shared ECDH groups is potentially problematic, and steps should be taken to generate your own parameters, but that doesn't make the cipher weak.
    – Polynomial
    Commented Jul 13, 2015 at 10:47
  • OK, fixed to be more accurate.
    – Vilican
    Commented Jul 13, 2015 at 11:15
  • @Polynomial: s/shared ECDH groups/shared DH groups/ ? Or s/shared ECDH groups/named ECDH curves/ ? Commented Jul 13, 2015 at 12:32
  • @StackzOfZtuff Sorry, I conflated the two.
    – Polynomial
    Commented Jul 13, 2015 at 12:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .