IntenseWebs/nginx
3
0 Fork 0
mirror of https://github.com/nginx/nginx.git synced 2026-10-26 07:20:04 -05:00
Code Issues Packages Projects Releases Wiki Activity

SSL: disabled TLSv1 and TLSv1.1 by default.

Browse Source 
TLSv1 and TLSv1.1 are formally deprecated and forbidden to negotiate due
to insufficient security reasons outlined in RFC 8996.

TLSv1 and TLSv1.1 are disabled in BoringSSL e95b0cad9 and LibreSSL 3.8.1
in the way they cannot be enabled in nginx configuration.  In OpenSSL 3.0,
they are only permitted at security level 0 (disabled by default).

The support is dropped in Chrome 84, Firefox 78, and deprecated in Safari.

This change disables TLSv1 and TLSv1.1 by default for OpenSSL 1.0.1 and
newer, where TLSv1.2 support is available.  For older library versions,
which do not have alternatives, these protocol versions remain enabled.
This commit is contained in:
Sergey Kandaurov authored and pluknet committed 2024-10-31 19:49:00 +04:00
1 parent f45c2707ea
commit ebd18ec181
7 files changed
+14
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/http/modules/ngx_http_grpc_module.c
+2
View File
@@ -4477,7 +4477,9 @@ ngx_http_grpc_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
ngx_conf_merge_bitmask_value(conf->ssl_protocols, prev->ssl_protocols,
(NGX_CONF_BITMASK_SET
#ifndef SSL_OP_NO_TLSv1_2
|NGX_SSL_TLSv1|NGX_SSL_TLSv1_1
#endif
|NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3));
ngx_conf_merge_str_value(conf->ssl_ciphers, prev->ssl_ciphers,
src/http/modules/ngx_http_proxy_module.c
+2
View File
@@ -3944,7 +3944,9 @@ ngx_http_proxy_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
ngx_conf_merge_bitmask_value(conf->ssl_protocols, prev->ssl_protocols,
(NGX_CONF_BITMASK_SET
#ifndef SSL_OP_NO_TLSv1_2
|NGX_SSL_TLSv1|NGX_SSL_TLSv1_1
#endif
|NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3));
ngx_conf_merge_str_value(conf->ssl_ciphers, prev->ssl_ciphers,
src/http/modules/ngx_http_ssl_module.c
+2
View File
@@ -653,7 +653,9 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
(NGX_CONF_BITMASK_SET
#ifndef SSL_OP_NO_TLSv1_2
|NGX_SSL_TLSv1|NGX_SSL_TLSv1_1
#endif
|NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3));
ngx_conf_merge_size_value(conf->buffer_size, prev->buffer_size,
src/http/modules/ngx_http_uwsgi_module.c
+2
View File
@@ -1879,7 +1879,9 @@ ngx_http_uwsgi_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
ngx_conf_merge_bitmask_value(conf->ssl_protocols, prev->ssl_protocols,
(NGX_CONF_BITMASK_SET
#ifndef SSL_OP_NO_TLSv1_2
|NGX_SSL_TLSv1|NGX_SSL_TLSv1_1
#endif
|NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3));
ngx_conf_merge_str_value(conf->ssl_ciphers, prev->ssl_ciphers,
src/mail/ngx_mail_ssl_module.c
+2
View File
@@ -345,7 +345,9 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
(NGX_CONF_BITMASK_SET
#ifndef SSL_OP_NO_TLSv1_2
|NGX_SSL_TLSv1|NGX_SSL_TLSv1_1
#endif
|NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3));
ngx_conf_merge_uint_value(conf->verify, prev->verify, 0);
src/stream/ngx_stream_proxy_module.c
+2
View File
@@ -2164,7 +2164,9 @@ ngx_stream_proxy_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
ngx_conf_merge_bitmask_value(conf->ssl_protocols, prev->ssl_protocols,
(NGX_CONF_BITMASK_SET
#ifndef SSL_OP_NO_TLSv1_2
|NGX_SSL_TLSv1|NGX_SSL_TLSv1_1
#endif
|NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3));
ngx_conf_merge_str_value(conf->ssl_ciphers, prev->ssl_ciphers, "DEFAULT");
src/stream/ngx_stream_ssl_module.c
+2
View File
@@ -884,7 +884,9 @@ ngx_stream_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
(NGX_CONF_BITMASK_SET
#ifndef SSL_OP_NO_TLSv1_2
|NGX_SSL_TLSv1|NGX_SSL_TLSv1_1
#endif
|NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3));
ngx_conf_merge_uint_value(conf->verify, prev->verify, 0);