SSL protocol and cipher configuration in Nginx - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Check enabled SSL protocols in Nginx

You run the command nginx -T | grep ssl_protocols on your server. What output do you expect if only TLSv1.2 and TLSv1.3 are enabled?

Nginx

nginx -T | grep ssl_protocols

A ssl_protocols TLSv1.1 TLSv1.2;

B ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;

C ssl_protocols SSLv3 TLSv1.2 TLSv1.3;

D ssl_protocols TLSv1.2 TLSv1.3;

💡 Hint

Only modern TLS versions TLSv1.2 and TLSv1.3 should be enabled for security.

The ssl_protocols directive lists enabled SSL/TLS versions. TLSv1.2 and TLSv1.3 are secure and recommended. Older versions like TLSv1, TLSv1.1, and SSLv3 are insecure and should be disabled.

❓ Configuration

intermediate

Configure strong cipher suites in Nginx

Which ssl_ciphers configuration line enables only strong ciphers recommended for modern browsers?

A ssl_ciphers NULL:!aNULL:!eNULL;

B ssl_ciphers ALL;

C ssl_ciphers HIGH:!aNULL:!MD5;

D ssl_ciphers LOW:MEDIUM:HIGH;

💡 Hint

Strong ciphers exclude anonymous and weak algorithms.

The HIGH:!aNULL:!MD5 cipher string enables only high-security ciphers, excluding anonymous (aNULL) and MD5-based ciphers which are weak or insecure.

❓ Troubleshoot

advanced

Troubleshoot SSL handshake failure due to protocol mismatch

A client reports SSL handshake failure connecting to your Nginx server. Your config has ssl_protocols TLSv1.3; only. The client supports TLSv1.2 but not TLSv1.3. What is the cause?

A Cipher suites are mismatched causing handshake failure.

B Client and server have no common SSL protocol version enabled.

C Nginx is missing the SSL certificate configuration.

D The server is using deprecated SSLv3 protocol.

💡 Hint

Handshake requires at least one common protocol version.

If the server only supports TLSv1.3 but the client supports only TLSv1.2, they cannot agree on a protocol version, causing handshake failure.

✅ Best Practice

advanced

Select the best SSL configuration for security and compatibility

Which Nginx SSL configuration balances strong security and broad client compatibility?

A ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers HIGH:!aNULL:!MD5; ssl_prefer_server_ciphers on;

B ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; ssl_ciphers ALL; ssl_prefer_server_ciphers off;

C ssl_protocols TLSv1.3; ssl_ciphers LOW:MEDIUM; ssl_prefer_server_ciphers on;

D ssl_protocols SSLv3 TLSv1.2; ssl_ciphers NULL; ssl_prefer_server_ciphers off;

💡 Hint

Avoid old protocols and weak ciphers but keep TLSv1.2 for compatibility.

Option A enables only secure protocols TLSv1.2 and TLSv1.3, uses strong ciphers, and prefers server cipher order for security. Other options enable insecure protocols or weak ciphers.

🧠 Conceptual

expert

Impact of disabling TLSv1.2 in Nginx SSL config

What is the most likely impact if you remove TLSv1.2 from ssl_protocols and keep only TLSv1.3 in Nginx?

A Clients that do not support TLSv1.3 will fail to connect, reducing compatibility.

B All clients will connect faster because TLSv1.3 is more efficient.

C The server will accept insecure SSLv3 connections as fallback.

D Cipher suites will automatically downgrade to weaker options.

💡 Hint

Consider client support for TLS versions.

Removing TLSv1.2 means clients that only support up to TLSv1.2 cannot connect, causing connection failures and reduced compatibility.

Practice

1. What is the purpose of the ssl_protocols directive in an nginx configuration?

easy

A. To specify which SSL/TLS protocol versions are allowed for secure connections

B. To define the encryption algorithms used for data compression

C. To set the maximum size of SSL certificates

D. To enable HTTP/2 support over SSL

Solution

1. Step 1: Understand the role of ssl_protocols

   The ssl_protocols directive controls which SSL/TLS versions nginx will accept for secure connections.

2. Step 2: Compare options with this role

   Only To specify which SSL/TLS protocol versions are allowed for secure connections correctly describes this purpose; others mention unrelated features like compression or HTTP/2.

3. Final Answer:

   To specify which SSL/TLS protocol versions are allowed for secure connections -> Option A

4. Quick Check:

   ssl_protocols = Allowed SSL/TLS versions [OK]

Hint: ssl_protocols controls TLS versions allowed [OK]

Common Mistakes:

• Confusing ssl_protocols with cipher settings
• Thinking ssl_protocols sets certificate size
• Assuming ssl_protocols enables HTTP/2

2. Which of the following is the correct syntax to enable only TLSv1.2 and TLSv1.3 in nginx?

easy

A. ssl_protocols tlsv12 tlsv13;

B. ssl_protocols tls1.2 tls1.3;

C. ssl_protocols TLSv1.2 TLSv1.3;

D. ssl_protocols TLS1_2 TLS1_3;

Solution

1. Step 1: Recall correct nginx ssl_protocols syntax

   The correct syntax uses capitalized TLS versions separated by spaces, ending with a semicolon, e.g., ssl_protocols TLSv1.2 TLSv1.3;.

2. Step 2: Check each option's format

   ssl_protocols TLSv1.2 TLSv1.3; matches the correct syntax exactly. Options A, B, and C use incorrect casing or underscores, which nginx does not accept.

3. Final Answer:

   ssl_protocols TLSv1.2 TLSv1.3; -> Option C

4. Quick Check:

   Correct syntax = ssl_protocols TLSv1.2 TLSv1.3; [OK]

Hint: Use exact case: TLSv1.2 TLSv1.3 with spaces [OK]

Common Mistakes:

• Using lowercase letters for TLS versions
• Replacing dots with underscores
• Missing semicolon at the end

3. Given this nginx snippet:

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;

What effect does ssl_prefer_server_ciphers on; have during SSL handshake?

medium

A. Client chooses the cipher from its list ignoring server preference

B. SSL handshake fails if client and server ciphers differ

C. Cipher selection is random between client and server lists

D. Server forces selection of its preferred cipher from the client's list

Solution

1. Step 1: Understand ssl_prefer_server_ciphers directive

   When set to on, nginx forces the server's cipher preference to override the client's during SSL handshake.

2. Step 2: Analyze options

   Server forces selection of its preferred cipher from the client's list correctly states the server enforces its cipher choice from the client's offered list. Client chooses the cipher from its list ignoring server preference is the opposite. Cipher selection is random between client and server lists is incorrect as selection is not random. SSL handshake fails if client and server ciphers differ is false; handshake does not fail just because of differing preferences.

3. Final Answer:

   Server forces selection of its preferred cipher from the client's list -> Option D

4. Quick Check:

   ssl_prefer_server_ciphers on = Server cipher priority [OK]

Hint: ssl_prefer_server_ciphers on means server picks cipher [OK]

Common Mistakes:

• Thinking client always chooses cipher
• Assuming random cipher selection
• Believing handshake fails on cipher mismatch

4. You configured nginx with:

ssl_protocols TLSv1.2 TLSv1.3
ssl_ciphers HIGH:!aNULL:!MD5
ssl_prefer_server_ciphers on;

But nginx fails to start. What is the likely cause?

medium

A. Missing semicolons at the end of directives

B. Using unsupported TLS versions

C. Incorrect cipher string syntax

D. ssl_prefer_server_ciphers must be off

Solution

1. Step 1: Check syntax of nginx directives

   Each directive must end with a semicolon. The given config lines miss semicolons at the end.

2. Step 2: Validate other options

   TLS versions and cipher strings are valid. ssl_prefer_server_ciphers can be on. So the syntax error (missing semicolons) causes nginx to fail.

3. Final Answer:

   Missing semicolons at the end of directives -> Option A

4. Quick Check:

   Missing semicolons cause config errors [OK]

Hint: Always end nginx directives with semicolon [OK]

Common Mistakes:

• Ignoring semicolon syntax errors
• Assuming TLS versions are unsupported
• Thinking ssl_prefer_server_ciphers must be off

5. You want to configure nginx to only allow TLSv1.3 and use strong ciphers, but also ensure clients that do not support TLSv1.3 can still connect securely using TLSv1.2. Which configuration snippet achieves this best?

hard

A. ssl_protocols TLSv1.3;
ssl_ciphers TLS_AES_256_GCM_SHA384;
ssl_prefer_server_ciphers on;

B. ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers TLS_AES_256_GCM_SHA384:HIGH:!aNULL;
ssl_prefer_server_ciphers on;

C. ssl_protocols TLSv1.2;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers off;

D. ssl_protocols TLSv1.3 TLSv1.1;
ssl_ciphers HIGH:!aNULL;
ssl_prefer_server_ciphers on;

Solution

1. Step 1: Identify required TLS versions

   We want to allow TLSv1.3 and TLSv1.2 to support clients without TLSv1.3.

2. Step 2: Check cipher configuration

   ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers TLS_AES_256_GCM_SHA384:HIGH:!aNULL; ssl_prefer_server_ciphers on; includes TLS_AES_256_GCM_SHA384 (a strong TLSv1.3 cipher) plus HIGH strength ciphers for TLSv1.2, with server cipher preference enabled.

3. Step 3: Validate other options

   ssl_protocols TLSv1.3; ssl_ciphers TLS_AES_256_GCM_SHA384; ssl_prefer_server_ciphers on; excludes TLSv1.2, blocking older clients. ssl_protocols TLSv1.2; ssl_ciphers HIGH:!aNULL:!MD5; ssl_prefer_server_ciphers off; excludes TLSv1.3. ssl_protocols TLSv1.3 TLSv1.1; ssl_ciphers HIGH:!aNULL; ssl_prefer_server_ciphers on; includes insecure TLSv1.1, which is deprecated.

4. Final Answer:

   ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers TLS_AES_256_GCM_SHA384:HIGH:!aNULL; ssl_prefer_server_ciphers on; -> Option B

5. Quick Check:

   Allow TLSv1.2 and TLSv1.3 with strong ciphers = ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers TLS_AES_256_GCM_SHA384:HIGH:!aNULL; ssl_prefer_server_ciphers on; [OK]

Hint: Include TLSv1.2 and TLSv1.3 with strong ciphers [OK]

Common Mistakes:

• Excluding TLSv1.2 and blocking older clients
• Including deprecated TLS versions like TLSv1.1
• Not combining strong ciphers for both TLS versions