SSL directive configuration in Nginx - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable SSL in the server block.

Nginx

server {
    listen 443 ssl;
    ssl_certificate [1];
}

Drag options to blanks, or click blank then click option'

A/usr/share/nginx/html

B/var/www/html/index.html

C/etc/nginx/nginx.conf

D/etc/ssl/certs/server.crt

Attempts:

3 left

💡 Hint

Common Mistakes

Using a directory path instead of a certificate file.

Confusing the certificate file with the private key file.

The ssl_certificate directive specifies the path to the SSL certificate file.

2fill in blank

medium

Complete the code to specify the SSL private key file.

Nginx

server {
    listen 443 ssl;
    ssl_certificate /etc/ssl/certs/server.crt;
    ssl_certificate_key [1];
}

Drag options to blanks, or click blank then click option'

A/etc/ssl/certs/server.crt

B/etc/ssl/private/server.key

C/var/log/nginx/error.log

D/usr/share/nginx/html/index.html

Attempts:

3 left

💡 Hint

Common Mistakes

Using the certificate file path instead of the key file.

Using a log file or HTML file path by mistake.

The ssl_certificate_key directive points to the private key file matching the SSL certificate.

3fill in blank

hard

Fix the error in the SSL protocol configuration line.

Nginx

server {
    listen 443 ssl;
    ssl_protocols [1];
}

Drag options to blanks, or click blank then click option'

ATLSv1.3 TLSv1.2

BTLSv1 TLSv1.1 TLSv1.2

CSSLv3 TLSv1

DHTTP/2 HTTPS

Attempts:

3 left

💡 Hint

Common Mistakes

Including insecure protocols like SSLv3.

Using unrelated protocols like HTTP/2 in ssl_protocols.

The ssl_protocols directive should list secure TLS versions like TLSv1.2 and TLSv1.3. Older protocols like SSLv3 are insecure and should be avoided.

4fill in blank

hard

Fill both blanks to enable strong ciphers and prefer server ciphers.

Nginx

server {
    listen 443 ssl;
    ssl_ciphers [1];
    ssl_prefer_server_ciphers [2];
}

Drag options to blanks, or click blank then click option'

A"HIGH:!aNULL:!MD5"

Bon

Coff

D"LOW:!SSLv2"

Attempts:

3 left

💡 Hint

Common Mistakes

Using weak cipher strings.

Turning off server cipher preference.

ssl_ciphers sets strong cipher suites, and ssl_prefer_server_ciphers on; tells Nginx to use server's cipher preference.

5fill in blank

hard

Fill all three blanks to configure SSL session cache and timeout.

Nginx

server {
    listen 443 ssl;
    ssl_session_cache [1];
    ssl_session_timeout [2];
    ssl_session_tickets [3];
}

Drag options to blanks, or click blank then click option'

Ashared:SSL:10m

B5m

Coff

Don

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect cache names or sizes.

Setting timeout too high or too low.

Leaving session tickets enabled when not needed.

ssl_session_cache shared:SSL:10m; enables shared cache for SSL sessions, ssl_session_timeout 5m; sets session timeout to 5 minutes, and ssl_session_tickets off; disables session tickets for better security.

Practice

1. Which nginx directive is used to specify the SSL certificate file for HTTPS?

easy

A. ssl_key_certificate

B. ssl_key

C. ssl_cert_file

D. ssl_certificate

Solution

1. Step 1: Understand SSL certificate directive

   The directive to specify the SSL certificate file in nginx is ssl_certificate.

2. Step 2: Compare options with correct syntax

   Options B, C, and D are incorrect because they are not valid nginx directives for SSL certificate files.

3. Final Answer:

   ssl_certificate -> Option D

4. Quick Check:

   ssl_certificate = ssl_certificate [OK]

Hint: Remember: certificate file uses ssl_certificate directive [OK]

Common Mistakes:

• Confusing ssl_certificate_key with ssl_certificate
• Using incorrect directive names like ssl_key
• Mixing certificate and key directives

2. Which of the following is the correct syntax to enable SSL in an nginx server block?

easy

A. ssl on;

B. enable ssl;

C. ssl_enable on;

D. ssl active;

Solution

1. Step 1: Recall SSL enabling syntax in nginx

   In older nginx versions, SSL was enabled with ssl on; inside the server block.

2. Step 2: Validate options

   Options A, B, and D are not valid nginx directives or syntax for enabling SSL.

3. Final Answer:

   ssl on; -> Option A

4. Quick Check:

   ssl on; = ssl on; [OK]

Hint: Use 'ssl on;' to enable SSL in nginx server block [OK]

Common Mistakes:

• Using non-existent directives like enable ssl
• Confusing directive names
• Omitting the semicolon

3. Given this nginx SSL configuration snippet, what TLS versions are allowed?

ssl_protocols TLSv1.2 TLSv1.3;

medium

A. TLS 1.0, 1.1, 1.2, and 1.3 are allowed

B. Only TLS 1.2 and TLS 1.3 are allowed

C. Only TLS 1.3 is allowed

D. No TLS versions are allowed

Solution

1. Step 1: Read ssl_protocols directive

   The directive ssl_protocols TLSv1.2 TLSv1.3; explicitly allows only TLS version 1.2 and 1.3.

2. Step 2: Understand allowed TLS versions

   Older versions like TLS 1.0 and 1.1 are not included, so they are disallowed.

3. Final Answer:

   Only TLS 1.2 and TLS 1.3 are allowed -> Option B

4. Quick Check:

   ssl_protocols = TLSv1.2 and TLSv1.3 [OK]

Hint: ssl_protocols lists allowed TLS versions explicitly [OK]

Common Mistakes:

• Assuming all TLS versions are allowed by default
• Confusing ssl_protocols with ssl_ciphers
• Ignoring missing older TLS versions

4. Identify the error in this nginx SSL configuration snippet:

ssl_certificate /etc/nginx/certs/server.crt
ssl_certificate_key /etc/nginx/certs/server.key;

medium

A. Missing semicolon after ssl_certificate directive

B. Wrong file path for ssl_certificate_key

C. ssl_certificate_key directive is misspelled

D. ssl_certificate directive should not have a file path

Solution

1. Step 1: Check syntax for each directive

   Each nginx directive must end with a semicolon. The first line lacks a semicolon.

2. Step 2: Verify other parts

   The file paths and directive names are correct, only the missing semicolon causes a syntax error.

3. Final Answer:

   Missing semicolon after ssl_certificate directive -> Option A

4. Quick Check:

   Every directive ends with ; [OK]

Hint: Always end nginx directives with a semicolon [OK]

Common Mistakes:

• Forgetting semicolons at line ends
• Assuming file paths are incorrect without checking
• Misspelling directive names

5. You want to configure nginx to use a strong cipher suite and only TLS 1.3. Which configuration snippet achieves this securely?

hard

A. ssl_protocols TLSv1.2;
ssl_ciphers 'TLS_AES_128_GCM_SHA256';

B. ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'HIGH:!aNULL:!MD5';

C. ssl_protocols TLSv1.3;
ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256';

D. ssl_protocols TLSv1.3;
ssl_ciphers 'ALL';

Solution

1. Step 1: Select TLS version

   Only TLS 1.3 is allowed by ssl_protocols TLSv1.3;, matching the requirement.

2. Step 2: Choose strong cipher suites

   ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256'; uses strong TLS 1.3 ciphers explicitly. Other options either allow older TLS versions, use insecure cipher lists, or use generic 'ALL' which is insecure.

3. Final Answer:

   ssl_protocols TLSv1.3; ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256'; -> Option C

4. Quick Check:

   Only TLS 1.3 + strong ciphers = ssl_protocols TLSv1.3; ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256'; [OK]

Hint: Use ssl_protocols TLSv1.3 and specify strong TLS 1.3 ciphers [OK]

Common Mistakes:

• Allowing older TLS versions accidentally
• Using 'ALL' cipher which is insecure
• Mismatch between TLS version and cipher suite