SSL directive configuration in Nginx - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Output of SSL certificate check command

What is the output of running openssl s_client -connect example.com:443 if the SSL certificate is valid and trusted?

Nginx

openssl s_client -connect example.com:443

A CONNECTED(00000003)\ndepth=2 C = US, O = Let's Encrypt, CN = R3\nverify return:1\n---\nCertificate chain\n 0 s:CN = example.com\n i:C = US, O = Let's Encrypt, CN = R3\n---\nSSL handshake has read 3456 bytes and written 456 bytes\n---\nNew, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384\n---\nVerify return code: 0 (ok)

B ERROR:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure\n139832123456768:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:ssl/record/rec_layer_s3.c:1543:SSL alert number 40

C CONNECTED(00000003)\ndepth=0 CN = example.com\nverify error:num=20:unable to get local issuer certificate\n---\nCertificate chain\n 0 s:CN = example.com\n i:C = US, O = Unknown CA, CN = Unknown\n---\nVerify return code: 20 (unable to get local issuer certificate)

D CONNECTED(00000003)\nno peer certificate available\n---\nNo client certificate CA names sent\n---\nSSL handshake has read 0 bytes and written 456 bytes\n---\nVerify return code: 0 (ok)

💡 Hint

Look for 'Verify return code: 0 (ok)' which means the certificate is valid.

Option A shows a successful SSL handshake with a valid certificate chain and no verification errors. Other options indicate handshake failure, unknown CA, or missing certificate.

❓ Configuration

intermediate

Correct SSL protocol configuration in nginx

Which nginx SSL configuration snippet correctly disables SSLv2 and SSLv3 but enables TLSv1.2 and TLSv1.3?

A ssl_protocols SSLv2 SSLv3 TLSv1.2 TLSv1.3;

B ssl_protocols TLSv1.2 TLSv1.3;

C ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;

D ssl_protocols SSLv3 TLSv1.2 TLSv1.3;

💡 Hint

Modern best practice disables SSLv2 and SSLv3 due to security risks.

Option B correctly enables only TLSv1.2 and TLSv1.3, which are secure protocols. Options B, C, and D include insecure protocols.

❓ Troubleshoot

advanced

Troubleshooting missing SSL certificate error

An nginx server fails to start with the error: nginx: [emerg] cannot load certificate "/etc/nginx/ssl/server.crt": BIO_new_file() failed. What is the most likely cause?

A The SSL certificate file is valid but the private key file is missing.

B The SSL certificate file is expired but still present.

C The SSL certificate file is in DER format instead of PEM format.

D The SSL certificate file /etc/nginx/ssl/server.crt does not exist or has wrong permissions.

💡 Hint

BIO_new_file() failure usually means file not found or unreadable.

The error indicates nginx cannot open the certificate file. This usually means the file is missing or nginx lacks permission to read it. Expired or format issues cause different errors.

🔀 Workflow

advanced

Order of SSL directives in nginx config

What is the correct order of these SSL directives inside an nginx server block for proper SSL setup?

A 4,3,2,1

B 1,2,3,4

C 3,4,1,2

D 2,1,3,4

💡 Hint

Protocol and cipher settings should come before specifying certificates.

The best practice is to first define protocols and ciphers, then specify certificate and key files. Option C reflects this order.

✅ Best Practice

expert

Best practice for SSL session cache configuration

Which nginx SSL session cache configuration is best for improving performance while maintaining security?

A ssl_session_cache shared:SSL:10m; ssl_session_timeout 10m;

B ssl_session_cache off; ssl_session_timeout 5m;

C ssl_session_cache shared:SSL:1m; ssl_session_timeout 1h;

D ssl_session_cache shared:SSL:50m; ssl_session_timeout 24h;

💡 Hint

Balance cache size and timeout to avoid memory waste and stale sessions.

Option A uses a reasonable cache size and timeout to improve SSL handshake speed without risking stale sessions or excessive memory use. Option A disables cache hurting performance. Option A cache is too small. Option A timeout is too long risking stale sessions.