SSL directive configuration in Nginx - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Output of SSL certificate check command

What is the output of running openssl s_client -connect example.com:443 if the SSL certificate is valid and trusted?

Nginx

openssl s_client -connect example.com:443

A CONNECTED(00000003)\ndepth=2 C = US, O = Let's Encrypt, CN = R3\nverify return:1\n---\nCertificate chain\n 0 s:CN = example.com\n i:C = US, O = Let's Encrypt, CN = R3\n---\nSSL handshake has read 3456 bytes and written 456 bytes\n---\nNew, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384\n---\nVerify return code: 0 (ok)

B ERROR:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure\n139832123456768:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:ssl/record/rec_layer_s3.c:1543:SSL alert number 40

C CONNECTED(00000003)\ndepth=0 CN = example.com\nverify error:num=20:unable to get local issuer certificate\n---\nCertificate chain\n 0 s:CN = example.com\n i:C = US, O = Unknown CA, CN = Unknown\n---\nVerify return code: 20 (unable to get local issuer certificate)

D CONNECTED(00000003)\nno peer certificate available\n---\nNo client certificate CA names sent\n---\nSSL handshake has read 0 bytes and written 456 bytes\n---\nVerify return code: 0 (ok)

💡 Hint

Look for 'Verify return code: 0 (ok)' which means the certificate is valid.

Option A shows a successful SSL handshake with a valid certificate chain and no verification errors. Other options indicate handshake failure, unknown CA, or missing certificate.

❓ Configuration

intermediate

Correct SSL protocol configuration in nginx

Which nginx SSL configuration snippet correctly disables SSLv2 and SSLv3 but enables TLSv1.2 and TLSv1.3?

A ssl_protocols SSLv2 SSLv3 TLSv1.2 TLSv1.3;

B ssl_protocols TLSv1.2 TLSv1.3;

C ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;

D ssl_protocols SSLv3 TLSv1.2 TLSv1.3;

💡 Hint

Modern best practice disables SSLv2 and SSLv3 due to security risks.

Option B correctly enables only TLSv1.2 and TLSv1.3, which are secure protocols. Options B, C, and D include insecure protocols.

❓ Troubleshoot

advanced

Troubleshooting missing SSL certificate error

An nginx server fails to start with the error: nginx: [emerg] cannot load certificate "/etc/nginx/ssl/server.crt": BIO_new_file() failed. What is the most likely cause?

A The SSL certificate file is valid but the private key file is missing.

B The SSL certificate file is expired but still present.

C The SSL certificate file is in DER format instead of PEM format.

D The SSL certificate file /etc/nginx/ssl/server.crt does not exist or has wrong permissions.

💡 Hint

BIO_new_file() failure usually means file not found or unreadable.

The error indicates nginx cannot open the certificate file. This usually means the file is missing or nginx lacks permission to read it. Expired or format issues cause different errors.

🔀 Workflow

advanced

Order of SSL directives in nginx config

What is the correct order of these SSL directives inside an nginx server block for proper SSL setup?

A 4,3,2,1

B 1,2,3,4

C 3,4,1,2

D 2,1,3,4

💡 Hint

Protocol and cipher settings should come before specifying certificates.

The best practice is to first define protocols and ciphers, then specify certificate and key files. Option C reflects this order.

✅ Best Practice

expert

Best practice for SSL session cache configuration

Which nginx SSL session cache configuration is best for improving performance while maintaining security?

A ssl_session_cache shared:SSL:10m; ssl_session_timeout 10m;

B ssl_session_cache off; ssl_session_timeout 5m;

C ssl_session_cache shared:SSL:1m; ssl_session_timeout 1h;

D ssl_session_cache shared:SSL:50m; ssl_session_timeout 24h;

💡 Hint

Balance cache size and timeout to avoid memory waste and stale sessions.

Option A uses a reasonable cache size and timeout to improve SSL handshake speed without risking stale sessions or excessive memory use. Option A disables cache hurting performance. Option A cache is too small. Option A timeout is too long risking stale sessions.

Practice

1. Which nginx directive is used to specify the SSL certificate file for HTTPS?

easy

A. ssl_key_certificate

B. ssl_key

C. ssl_cert_file

D. ssl_certificate

Solution

1. Step 1: Understand SSL certificate directive

   The directive to specify the SSL certificate file in nginx is ssl_certificate.

2. Step 2: Compare options with correct syntax

   Options B, C, and D are incorrect because they are not valid nginx directives for SSL certificate files.

3. Final Answer:

   ssl_certificate -> Option D

4. Quick Check:

   ssl_certificate = ssl_certificate [OK]

Hint: Remember: certificate file uses ssl_certificate directive [OK]

Common Mistakes:

• Confusing ssl_certificate_key with ssl_certificate
• Using incorrect directive names like ssl_key
• Mixing certificate and key directives

2. Which of the following is the correct syntax to enable SSL in an nginx server block?

easy

A. ssl on;

B. enable ssl;

C. ssl_enable on;

D. ssl active;

Solution

1. Step 1: Recall SSL enabling syntax in nginx

   In older nginx versions, SSL was enabled with ssl on; inside the server block.

2. Step 2: Validate options

   Options A, B, and D are not valid nginx directives or syntax for enabling SSL.

3. Final Answer:

   ssl on; -> Option A

4. Quick Check:

   ssl on; = ssl on; [OK]

Hint: Use 'ssl on;' to enable SSL in nginx server block [OK]

Common Mistakes:

• Using non-existent directives like enable ssl
• Confusing directive names
• Omitting the semicolon

3. Given this nginx SSL configuration snippet, what TLS versions are allowed?

ssl_protocols TLSv1.2 TLSv1.3;

medium

A. TLS 1.0, 1.1, 1.2, and 1.3 are allowed

B. Only TLS 1.2 and TLS 1.3 are allowed

C. Only TLS 1.3 is allowed

D. No TLS versions are allowed

Solution

1. Step 1: Read ssl_protocols directive

   The directive ssl_protocols TLSv1.2 TLSv1.3; explicitly allows only TLS version 1.2 and 1.3.

2. Step 2: Understand allowed TLS versions

   Older versions like TLS 1.0 and 1.1 are not included, so they are disallowed.

3. Final Answer:

   Only TLS 1.2 and TLS 1.3 are allowed -> Option B

4. Quick Check:

   ssl_protocols = TLSv1.2 and TLSv1.3 [OK]

Hint: ssl_protocols lists allowed TLS versions explicitly [OK]

Common Mistakes:

• Assuming all TLS versions are allowed by default
• Confusing ssl_protocols with ssl_ciphers
• Ignoring missing older TLS versions

4. Identify the error in this nginx SSL configuration snippet:

ssl_certificate /etc/nginx/certs/server.crt
ssl_certificate_key /etc/nginx/certs/server.key;

medium

A. Missing semicolon after ssl_certificate directive

B. Wrong file path for ssl_certificate_key

C. ssl_certificate_key directive is misspelled

D. ssl_certificate directive should not have a file path

Solution

1. Step 1: Check syntax for each directive

   Each nginx directive must end with a semicolon. The first line lacks a semicolon.

2. Step 2: Verify other parts

   The file paths and directive names are correct, only the missing semicolon causes a syntax error.

3. Final Answer:

   Missing semicolon after ssl_certificate directive -> Option A

4. Quick Check:

   Every directive ends with ; [OK]

Hint: Always end nginx directives with a semicolon [OK]

Common Mistakes:

• Forgetting semicolons at line ends
• Assuming file paths are incorrect without checking
• Misspelling directive names

5. You want to configure nginx to use a strong cipher suite and only TLS 1.3. Which configuration snippet achieves this securely?

hard

A. ssl_protocols TLSv1.2;
ssl_ciphers 'TLS_AES_128_GCM_SHA256';

B. ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'HIGH:!aNULL:!MD5';

C. ssl_protocols TLSv1.3;
ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256';

D. ssl_protocols TLSv1.3;
ssl_ciphers 'ALL';

Solution

1. Step 1: Select TLS version

   Only TLS 1.3 is allowed by ssl_protocols TLSv1.3;, matching the requirement.

2. Step 2: Choose strong cipher suites

   ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256'; uses strong TLS 1.3 ciphers explicitly. Other options either allow older TLS versions, use insecure cipher lists, or use generic 'ALL' which is insecure.

3. Final Answer:

   ssl_protocols TLSv1.3; ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256'; -> Option C

4. Quick Check:

   Only TLS 1.3 + strong ciphers = ssl_protocols TLSv1.3; ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256'; [OK]

Hint: Use ssl_protocols TLSv1.3 and specify strong TLS 1.3 ciphers [OK]

Common Mistakes:

• Allowing older TLS versions accidentally
• Using 'ALL' cipher which is insecure
• Mismatch between TLS version and cipher suite