SSL protocol and cipher configuration in Nginx - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Check enabled SSL protocols in Nginx

You run the command nginx -T | grep ssl_protocols on your server. What output do you expect if only TLSv1.2 and TLSv1.3 are enabled?

Nginx

nginx -T | grep ssl_protocols

A ssl_protocols TLSv1.1 TLSv1.2;

B ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;

C ssl_protocols SSLv3 TLSv1.2 TLSv1.3;

D ssl_protocols TLSv1.2 TLSv1.3;

💡 Hint

Only modern TLS versions TLSv1.2 and TLSv1.3 should be enabled for security.

The ssl_protocols directive lists enabled SSL/TLS versions. TLSv1.2 and TLSv1.3 are secure and recommended. Older versions like TLSv1, TLSv1.1, and SSLv3 are insecure and should be disabled.

❓ Configuration

intermediate

Configure strong cipher suites in Nginx

Which ssl_ciphers configuration line enables only strong ciphers recommended for modern browsers?

A ssl_ciphers NULL:!aNULL:!eNULL;

B ssl_ciphers ALL;

C ssl_ciphers HIGH:!aNULL:!MD5;

D ssl_ciphers LOW:MEDIUM:HIGH;

💡 Hint

Strong ciphers exclude anonymous and weak algorithms.

The HIGH:!aNULL:!MD5 cipher string enables only high-security ciphers, excluding anonymous (aNULL) and MD5-based ciphers which are weak or insecure.

❓ Troubleshoot

advanced

Troubleshoot SSL handshake failure due to protocol mismatch

A client reports SSL handshake failure connecting to your Nginx server. Your config has ssl_protocols TLSv1.3; only. The client supports TLSv1.2 but not TLSv1.3. What is the cause?

A Cipher suites are mismatched causing handshake failure.

B Client and server have no common SSL protocol version enabled.

C Nginx is missing the SSL certificate configuration.

D The server is using deprecated SSLv3 protocol.

💡 Hint

Handshake requires at least one common protocol version.

If the server only supports TLSv1.3 but the client supports only TLSv1.2, they cannot agree on a protocol version, causing handshake failure.

✅ Best Practice

advanced

Select the best SSL configuration for security and compatibility

Which Nginx SSL configuration balances strong security and broad client compatibility?

A ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers HIGH:!aNULL:!MD5; ssl_prefer_server_ciphers on;

B ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; ssl_ciphers ALL; ssl_prefer_server_ciphers off;

C ssl_protocols TLSv1.3; ssl_ciphers LOW:MEDIUM; ssl_prefer_server_ciphers on;

D ssl_protocols SSLv3 TLSv1.2; ssl_ciphers NULL; ssl_prefer_server_ciphers off;

💡 Hint

Avoid old protocols and weak ciphers but keep TLSv1.2 for compatibility.

Option A enables only secure protocols TLSv1.2 and TLSv1.3, uses strong ciphers, and prefers server cipher order for security. Other options enable insecure protocols or weak ciphers.

🧠 Conceptual

expert

Impact of disabling TLSv1.2 in Nginx SSL config

What is the most likely impact if you remove TLSv1.2 from ssl_protocols and keep only TLSv1.3 in Nginx?

A Clients that do not support TLSv1.3 will fail to connect, reducing compatibility.

B All clients will connect faster because TLSv1.3 is more efficient.

C The server will accept insecure SSLv3 connections as fallback.

D Cipher suites will automatically downgrade to weaker options.

💡 Hint

Consider client support for TLS versions.

Removing TLSv1.2 means clients that only support up to TLSv1.2 cannot connect, causing connection failures and reduced compatibility.