SSL protocol and cipher configuration in Nginx - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable only TLS protocols in nginx.

Nginx

ssl_protocols [1];

Drag options to blanks, or click blank then click option'

ATLSv1 TLSv1.1 TLSv1.2 TLSv1.3

BSSLv3 TLSv1

CSSLv2 SSLv3

DTLSv1.2 SSLv3

Attempts:

3 left

💡 Hint

Common Mistakes

Including SSLv3 or SSLv2 which are insecure.

Forgetting to include TLSv1.3.

The ssl_protocols directive specifies which SSL/TLS protocols nginx will accept. Modern best practice is to enable only TLS versions, excluding SSL versions.

2fill in blank

medium

Complete the code to set a strong cipher suite in nginx.

Nginx

ssl_ciphers [1];

Drag options to blanks, or click blank then click option'

A"EXP:!aNULL:!MD5"

B"HIGH:!aNULL:!MD5"

C"ALL"

D"LOW:!aNULL:!MD5"

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'ALL' which includes weak ciphers.

Including 'LOW' or 'EXP' which are weak or export ciphers.

The ssl_ciphers directive defines which encryption algorithms nginx will allow. "HIGH:!aNULL:!MD5" enables strong ciphers and excludes anonymous and weak ones.

3fill in blank

hard

Fix the error in the ssl_prefer_server_ciphers directive to prefer server ciphers.

Nginx

ssl_prefer_server_ciphers [1];

Drag options to blanks, or click blank then click option'

Ayes

Btrue

Coff

Don

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'true' or 'yes' instead of 'on'.

Leaving the directive off which disables server cipher preference.

The correct value to enable server cipher preference in nginx is on. Values like 'true' or 'yes' are invalid here.

4fill in blank

hard

Fill both blanks to configure nginx to use only TLSv1.2 and TLSv1.3 and prefer server ciphers.

Nginx

ssl_protocols [1];
ssl_prefer_server_ciphers [2];

Drag options to blanks, or click blank then click option'

ATLSv1.2 TLSv1.3

Boff

Con

DSSLv3

Attempts:

3 left

💡 Hint

Common Mistakes

Including SSLv3 in protocols.

Using 'off' for server cipher preference.

Setting ssl_protocols to only TLSv1.2 and TLSv1.3 ensures modern secure protocols. Setting ssl_prefer_server_ciphers to on makes nginx choose the server's preferred ciphers.

5fill in blank

hard

Fill all three blanks to configure nginx with strong ciphers, enable TLSv1.2 and TLSv1.3, and prefer server ciphers.

Nginx

ssl_ciphers [1];
ssl_protocols [2];
ssl_prefer_server_ciphers [3];

Drag options to blanks, or click blank then click option'

A"HIGH:!aNULL:!MD5"

BTLSv1.2 TLSv1.3

Con

Doff

Attempts:

3 left

💡 Hint

Common Mistakes

Using weak cipher strings.

Including SSL protocols.

Disabling server cipher preference.

This configuration sets strong ciphers, limits protocols to TLSv1.2 and TLSv1.3, and enables server cipher preference for better security.

Practice

1. What is the purpose of the ssl_protocols directive in an nginx configuration?

easy

A. To specify which SSL/TLS protocol versions are allowed for secure connections

B. To define the encryption algorithms used for data compression

C. To set the maximum size of SSL certificates

D. To enable HTTP/2 support over SSL

Solution

1. Step 1: Understand the role of ssl_protocols

   The ssl_protocols directive controls which SSL/TLS versions nginx will accept for secure connections.

2. Step 2: Compare options with this role

   Only To specify which SSL/TLS protocol versions are allowed for secure connections correctly describes this purpose; others mention unrelated features like compression or HTTP/2.

3. Final Answer:

   To specify which SSL/TLS protocol versions are allowed for secure connections -> Option A

4. Quick Check:

   ssl_protocols = Allowed SSL/TLS versions [OK]

Hint: ssl_protocols controls TLS versions allowed [OK]

Common Mistakes:

• Confusing ssl_protocols with cipher settings
• Thinking ssl_protocols sets certificate size
• Assuming ssl_protocols enables HTTP/2

2. Which of the following is the correct syntax to enable only TLSv1.2 and TLSv1.3 in nginx?

easy

A. ssl_protocols tlsv12 tlsv13;

B. ssl_protocols tls1.2 tls1.3;

C. ssl_protocols TLSv1.2 TLSv1.3;

D. ssl_protocols TLS1_2 TLS1_3;

Solution

1. Step 1: Recall correct nginx ssl_protocols syntax

   The correct syntax uses capitalized TLS versions separated by spaces, ending with a semicolon, e.g., ssl_protocols TLSv1.2 TLSv1.3;.

2. Step 2: Check each option's format

   ssl_protocols TLSv1.2 TLSv1.3; matches the correct syntax exactly. Options A, B, and C use incorrect casing or underscores, which nginx does not accept.

3. Final Answer:

   ssl_protocols TLSv1.2 TLSv1.3; -> Option C

4. Quick Check:

   Correct syntax = ssl_protocols TLSv1.2 TLSv1.3; [OK]

Hint: Use exact case: TLSv1.2 TLSv1.3 with spaces [OK]

Common Mistakes:

• Using lowercase letters for TLS versions
• Replacing dots with underscores
• Missing semicolon at the end

3. Given this nginx snippet:

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;

What effect does ssl_prefer_server_ciphers on; have during SSL handshake?

medium

A. Client chooses the cipher from its list ignoring server preference

B. SSL handshake fails if client and server ciphers differ

C. Cipher selection is random between client and server lists

D. Server forces selection of its preferred cipher from the client's list

Solution

1. Step 1: Understand ssl_prefer_server_ciphers directive

   When set to on, nginx forces the server's cipher preference to override the client's during SSL handshake.

2. Step 2: Analyze options

   Server forces selection of its preferred cipher from the client's list correctly states the server enforces its cipher choice from the client's offered list. Client chooses the cipher from its list ignoring server preference is the opposite. Cipher selection is random between client and server lists is incorrect as selection is not random. SSL handshake fails if client and server ciphers differ is false; handshake does not fail just because of differing preferences.

3. Final Answer:

   Server forces selection of its preferred cipher from the client's list -> Option D

4. Quick Check:

   ssl_prefer_server_ciphers on = Server cipher priority [OK]

Hint: ssl_prefer_server_ciphers on means server picks cipher [OK]

Common Mistakes:

• Thinking client always chooses cipher
• Assuming random cipher selection
• Believing handshake fails on cipher mismatch

4. You configured nginx with:

ssl_protocols TLSv1.2 TLSv1.3
ssl_ciphers HIGH:!aNULL:!MD5
ssl_prefer_server_ciphers on;

But nginx fails to start. What is the likely cause?

medium

A. Missing semicolons at the end of directives

B. Using unsupported TLS versions

C. Incorrect cipher string syntax

D. ssl_prefer_server_ciphers must be off

Solution

1. Step 1: Check syntax of nginx directives

   Each directive must end with a semicolon. The given config lines miss semicolons at the end.

2. Step 2: Validate other options

   TLS versions and cipher strings are valid. ssl_prefer_server_ciphers can be on. So the syntax error (missing semicolons) causes nginx to fail.

3. Final Answer:

   Missing semicolons at the end of directives -> Option A

4. Quick Check:

   Missing semicolons cause config errors [OK]

Hint: Always end nginx directives with semicolon [OK]

Common Mistakes:

• Ignoring semicolon syntax errors
• Assuming TLS versions are unsupported
• Thinking ssl_prefer_server_ciphers must be off

5. You want to configure nginx to only allow TLSv1.3 and use strong ciphers, but also ensure clients that do not support TLSv1.3 can still connect securely using TLSv1.2. Which configuration snippet achieves this best?

hard

A. ssl_protocols TLSv1.3;
ssl_ciphers TLS_AES_256_GCM_SHA384;
ssl_prefer_server_ciphers on;

B. ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers TLS_AES_256_GCM_SHA384:HIGH:!aNULL;
ssl_prefer_server_ciphers on;

C. ssl_protocols TLSv1.2;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers off;

D. ssl_protocols TLSv1.3 TLSv1.1;
ssl_ciphers HIGH:!aNULL;
ssl_prefer_server_ciphers on;

Solution

1. Step 1: Identify required TLS versions

   We want to allow TLSv1.3 and TLSv1.2 to support clients without TLSv1.3.

2. Step 2: Check cipher configuration

   ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers TLS_AES_256_GCM_SHA384:HIGH:!aNULL; ssl_prefer_server_ciphers on; includes TLS_AES_256_GCM_SHA384 (a strong TLSv1.3 cipher) plus HIGH strength ciphers for TLSv1.2, with server cipher preference enabled.

3. Step 3: Validate other options

   ssl_protocols TLSv1.3; ssl_ciphers TLS_AES_256_GCM_SHA384; ssl_prefer_server_ciphers on; excludes TLSv1.2, blocking older clients. ssl_protocols TLSv1.2; ssl_ciphers HIGH:!aNULL:!MD5; ssl_prefer_server_ciphers off; excludes TLSv1.3. ssl_protocols TLSv1.3 TLSv1.1; ssl_ciphers HIGH:!aNULL; ssl_prefer_server_ciphers on; includes insecure TLSv1.1, which is deprecated.

4. Final Answer:

   ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers TLS_AES_256_GCM_SHA384:HIGH:!aNULL; ssl_prefer_server_ciphers on; -> Option B

5. Quick Check:

   Allow TLSv1.2 and TLSv1.3 with strong ciphers = ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers TLS_AES_256_GCM_SHA384:HIGH:!aNULL; ssl_prefer_server_ciphers on; [OK]

Hint: Include TLSv1.2 and TLSv1.3 with strong ciphers [OK]

Common Mistakes:

• Excluding TLSv1.2 and blocking older clients
• Including deprecated TLS versions like TLSv1.1
• Not combining strong ciphers for both TLS versions