Fabiano,

Is it possible that you have nginx.org/r/ssl_reject_handshake configured in another server block listening on 10.0.0.2:443?
Is there anything useful in nginx error log?

My guess, using -servername option will resolve the issue for you.

Regards,
Igor.

On 24/08/2022 21:22, Fabiano Furtado Pessoa Coelho wrote:
Hi...

I'm using NGINX 1.22.0 with OpenSSL 3.0.5 in a Linux x86_64 server
with one NIC and 2 IPs, with the following config:

   * config based on
https://ssl-config.mozilla.org/#server=nginx&version=1.22.0&config=intermediate&openssl=3.0.5&guideline=5.6

1st) IP 10.0.0.1 with intermediate config (only TLS 1.2 and 1.3 enabled):

server {
   listen 10.0.0.1:443 ssl http2;
   server_name secure.example.com;

   ssl_session_cache shared:SSL_intermediate:10m;

   ssl_dhparam /etc/nginx/dhparams.pem;

   ssl_protocols TLSv1.2 TLSv1.3;
   ssl_ciphers 
ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
   ssl_prefer_server_ciphers off;
   ...
}

2nd) IP 10.0.0.2 with old config (TLS 1.0 through 1.3 enabled):

server {
   listen 10.0.0.2:443 ssl http2;
   server_name insecure.example.com;

   ssl_session_cache shared:SSL_old:10m;

   ssl_dhparam /etc/nginx/dhparams.pem;

   ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
   ssl_ciphers 
ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA;
   ssl_prefer_server_ciphers on;
   ...
}


$ netstat -nlpt | grep nginx | sort
tcp     0     0 10.0.0.1:443      0.0.0.0:*         LISTEN
1337/nginx: master p
tcp     0     0 10.0.0.2:443      0.0.0.0:*         LISTEN
1337/nginx: master p


Trying TLS 1.0:

$ openssl s_client -connect insecure.example.com:443 -tls1
CONNECTED(00000003)
00FCC7F5507F0000:error:0A00042E:SSL routines:ssl3_read_bytes:tlsv1
alert protocol version:ssl/record/rec_layer_s3.c:1584:SSL alert number
70
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 135 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
     Protocol  : TLSv1
     Cipher    : 0000
     Session-ID:
     Session-ID-ctx:
     Master-Key:
     PSK identity: None
     PSK identity hint: None
     SRP username: None
     Start Time: 1661371345
     Timeout   : 7200 (sec)
     Verify return code: 0 (ok)
     Extended master secret: no
---


Trying TLS 1.1:

$ openssl s_client -connect insecure.example.com:443 -tls1_1
CONNECTED(00000003)
00FC0A99AB7F0000:error:0A00042E:SSL routines:ssl3_read_bytes:tlsv1
alert protocol version:ssl/record/rec_layer_s3.c:1584:SSL alert number
70
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 135 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
     Protocol  : TLSv1.1
     Cipher    : 0000
     Session-ID:
     Session-ID-ctx:
     Master-Key:
     PSK identity: None
     PSK identity hint: None
     SRP username: None
     Start Time: 1661371360
     Timeout   : 7200 (sec)
     Verify return code: 0 (ok)
     Extended master secret: no
---


Why I can't connect with TLS 1.0 or 1.1 on insecure.example.com?

Is this an OpenSSL 3 issue? Does it work with OpenSSL 1.1.1?

I have separated the "ssl_protocols" by IP and there is no others
"ssl_protocols" directives configured outside of server{} block.

Thanks.
_______________________________________________
nginx mailing list -- nginx@nginx.org
To unsubscribe send an email to nginx-le...@nginx.org


_______________________________________________
nginx mailing list -- nginx@nginx.org
To unsubscribe send an email to nginx-le...@nginx.org

Reply via email to