SSL protocol and cipher configuration in Nginx - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of configuring SSL protocols in nginx?

Configuring SSL protocols in nginx controls which versions of SSL/TLS are allowed for secure connections. This helps improve security by disabling outdated or vulnerable protocols.

beginner

What does the ssl_protocols directive do in nginx?

The ssl_protocols directive specifies which SSL/TLS protocol versions nginx will accept for HTTPS connections, such as TLSv1.2 and TLSv1.3.

intermediate

Why is it important to configure cipher suites in nginx?

Cipher suites determine the encryption algorithms used during SSL/TLS connections. Configuring them ensures strong encryption and prevents weak or vulnerable ciphers from being used.

intermediate

What is the effect of this nginx directive?
ssl_ciphers 'HIGH:!aNULL:!MD5';

This directive tells nginx to use only strong ciphers (HIGH), exclude anonymous authentication ciphers (!aNULL), and exclude ciphers using MD5 hashing (!MD5), improving security.

beginner

How can you disable SSLv3 and TLSv1.0 in nginx?

By setting ssl_protocols TLSv1.2 TLSv1.3; in the nginx configuration, you disable SSLv3 and TLSv1.0, allowing only TLS 1.2 and 1.3 protocols.

Which nginx directive controls the SSL/TLS protocol versions allowed?

A ssl_protocols

B ssl_ciphers

C ssl_certificate

D ssl_session_cache

The ssl_protocols directive sets which SSL/TLS versions nginx accepts.

What does the exclamation mark (!) mean in the ssl_ciphers directive?

A Set cipher priority

B Include the cipher

C Exclude the cipher

D Enable anonymous ciphers

The exclamation mark excludes the specified cipher from the list.

Which SSL/TLS protocols are recommended to enable in nginx for best security?

A TLSv1.2 and TLSv1.3

B SSLv3 and TLSv1.0

C TLSv1.0 and TLSv1.1

D SSLv2 and SSLv3

TLSv1.2 and TLSv1.3 are modern and secure protocols recommended for use.

What is the main risk of allowing weak ciphers in SSL configuration?

A Slower connection speed

B Increased server load

C Compatibility issues with browsers

D Security vulnerabilities and data breaches

Weak ciphers can be exploited, leading to security breaches.

How do you specify multiple protocols in the ssl_protocols directive?

A Separate by commas

B Separate by spaces

C Use semicolons

D Use colons

Protocols are listed separated by spaces, e.g., ssl_protocols TLSv1.2 TLSv1.3;

Explain how to configure nginx to use only TLS 1.2 and TLS 1.3 protocols and strong cipher suites.

Think about which protocols to allow and how to exclude weak ciphers.

Describe why disabling older SSL protocols like SSLv3 is important in nginx SSL configuration.

Consider the risks of outdated encryption methods.

Practice

1. What is the purpose of the ssl_protocols directive in an nginx configuration?

easy

A. To specify which SSL/TLS protocol versions are allowed for secure connections

B. To define the encryption algorithms used for data compression

C. To set the maximum size of SSL certificates

D. To enable HTTP/2 support over SSL

Solution

1. Step 1: Understand the role of ssl_protocols

   The ssl_protocols directive controls which SSL/TLS versions nginx will accept for secure connections.

2. Step 2: Compare options with this role

   Only To specify which SSL/TLS protocol versions are allowed for secure connections correctly describes this purpose; others mention unrelated features like compression or HTTP/2.

3. Final Answer:

   To specify which SSL/TLS protocol versions are allowed for secure connections -> Option A

4. Quick Check:

   ssl_protocols = Allowed SSL/TLS versions [OK]

Hint: ssl_protocols controls TLS versions allowed [OK]

Common Mistakes:

• Confusing ssl_protocols with cipher settings
• Thinking ssl_protocols sets certificate size
• Assuming ssl_protocols enables HTTP/2

2. Which of the following is the correct syntax to enable only TLSv1.2 and TLSv1.3 in nginx?

easy

A. ssl_protocols tlsv12 tlsv13;

B. ssl_protocols tls1.2 tls1.3;

C. ssl_protocols TLSv1.2 TLSv1.3;

D. ssl_protocols TLS1_2 TLS1_3;

Solution

1. Step 1: Recall correct nginx ssl_protocols syntax

   The correct syntax uses capitalized TLS versions separated by spaces, ending with a semicolon, e.g., ssl_protocols TLSv1.2 TLSv1.3;.

2. Step 2: Check each option's format

   ssl_protocols TLSv1.2 TLSv1.3; matches the correct syntax exactly. Options A, B, and C use incorrect casing or underscores, which nginx does not accept.

3. Final Answer:

   ssl_protocols TLSv1.2 TLSv1.3; -> Option C

4. Quick Check:

   Correct syntax = ssl_protocols TLSv1.2 TLSv1.3; [OK]

Hint: Use exact case: TLSv1.2 TLSv1.3 with spaces [OK]

Common Mistakes:

• Using lowercase letters for TLS versions
• Replacing dots with underscores
• Missing semicolon at the end

3. Given this nginx snippet:

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;

What effect does ssl_prefer_server_ciphers on; have during SSL handshake?

medium

A. Client chooses the cipher from its list ignoring server preference

B. SSL handshake fails if client and server ciphers differ

C. Cipher selection is random between client and server lists

D. Server forces selection of its preferred cipher from the client's list

Solution

1. Step 1: Understand ssl_prefer_server_ciphers directive

   When set to on, nginx forces the server's cipher preference to override the client's during SSL handshake.

2. Step 2: Analyze options

   Server forces selection of its preferred cipher from the client's list correctly states the server enforces its cipher choice from the client's offered list. Client chooses the cipher from its list ignoring server preference is the opposite. Cipher selection is random between client and server lists is incorrect as selection is not random. SSL handshake fails if client and server ciphers differ is false; handshake does not fail just because of differing preferences.

3. Final Answer:

   Server forces selection of its preferred cipher from the client's list -> Option D

4. Quick Check:

   ssl_prefer_server_ciphers on = Server cipher priority [OK]

Hint: ssl_prefer_server_ciphers on means server picks cipher [OK]

Common Mistakes:

• Thinking client always chooses cipher
• Assuming random cipher selection
• Believing handshake fails on cipher mismatch

4. You configured nginx with:

ssl_protocols TLSv1.2 TLSv1.3
ssl_ciphers HIGH:!aNULL:!MD5
ssl_prefer_server_ciphers on;

But nginx fails to start. What is the likely cause?

medium

A. Missing semicolons at the end of directives

B. Using unsupported TLS versions

C. Incorrect cipher string syntax

D. ssl_prefer_server_ciphers must be off

Solution

1. Step 1: Check syntax of nginx directives

   Each directive must end with a semicolon. The given config lines miss semicolons at the end.

2. Step 2: Validate other options

   TLS versions and cipher strings are valid. ssl_prefer_server_ciphers can be on. So the syntax error (missing semicolons) causes nginx to fail.

3. Final Answer:

   Missing semicolons at the end of directives -> Option A

4. Quick Check:

   Missing semicolons cause config errors [OK]

Hint: Always end nginx directives with semicolon [OK]

Common Mistakes:

• Ignoring semicolon syntax errors
• Assuming TLS versions are unsupported
• Thinking ssl_prefer_server_ciphers must be off

5. You want to configure nginx to only allow TLSv1.3 and use strong ciphers, but also ensure clients that do not support TLSv1.3 can still connect securely using TLSv1.2. Which configuration snippet achieves this best?

hard

A. ssl_protocols TLSv1.3;
ssl_ciphers TLS_AES_256_GCM_SHA384;
ssl_prefer_server_ciphers on;

B. ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers TLS_AES_256_GCM_SHA384:HIGH:!aNULL;
ssl_prefer_server_ciphers on;

C. ssl_protocols TLSv1.2;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers off;

D. ssl_protocols TLSv1.3 TLSv1.1;
ssl_ciphers HIGH:!aNULL;
ssl_prefer_server_ciphers on;

Solution

1. Step 1: Identify required TLS versions

   We want to allow TLSv1.3 and TLSv1.2 to support clients without TLSv1.3.

2. Step 2: Check cipher configuration

   ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers TLS_AES_256_GCM_SHA384:HIGH:!aNULL; ssl_prefer_server_ciphers on; includes TLS_AES_256_GCM_SHA384 (a strong TLSv1.3 cipher) plus HIGH strength ciphers for TLSv1.2, with server cipher preference enabled.

3. Step 3: Validate other options

   ssl_protocols TLSv1.3; ssl_ciphers TLS_AES_256_GCM_SHA384; ssl_prefer_server_ciphers on; excludes TLSv1.2, blocking older clients. ssl_protocols TLSv1.2; ssl_ciphers HIGH:!aNULL:!MD5; ssl_prefer_server_ciphers off; excludes TLSv1.3. ssl_protocols TLSv1.3 TLSv1.1; ssl_ciphers HIGH:!aNULL; ssl_prefer_server_ciphers on; includes insecure TLSv1.1, which is deprecated.

4. Final Answer:

   ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers TLS_AES_256_GCM_SHA384:HIGH:!aNULL; ssl_prefer_server_ciphers on; -> Option B

5. Quick Check:

   Allow TLSv1.2 and TLSv1.3 with strong ciphers = ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers TLS_AES_256_GCM_SHA384:HIGH:!aNULL; ssl_prefer_server_ciphers on; [OK]

Hint: Include TLSv1.2 and TLSv1.3 with strong ciphers [OK]

Common Mistakes:

• Excluding TLSv1.2 and blocking older clients
• Including deprecated TLS versions like TLSv1.1
• Not combining strong ciphers for both TLS versions