From fc9b9b91151cf616d95ecfd7a82ee8e228f0e3c5 Mon Sep 17 00:00:00 2001 From: Wonderfall Date: Sat, 11 Jun 2016 12:59:07 +0200 Subject: [PATCH] nginx: disable CBC modes + TLS v1.2 only --- nginx/ssl_params | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nginx/ssl_params b/nginx/ssl_params index bd0304a..6dac8aa 100644 --- a/nginx/ssl_params +++ b/nginx/ssl_params @@ -1,6 +1,6 @@ -ssl_protocols TLSv1 TLSv1.1 TLSv1.2; +ssl_protocols TLSv1.2; ssl_ecdh_curve secp384r1; -ssl_ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-CHACHA20-POLY1305-D:ECDHE-RSA-CHACHA20-POLY1305-D:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA; +ssl_ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-CHACHA20-POLY1305-D:ECDHE-RSA-CHACHA20-POLY1305-D:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256; ssl_prefer_server_ciphers on; ssl_session_cache shared:SSL:20m;