Hello!

On Thu, Oct 16, 2014 at 03:40:44AM -0400, Jessica Litwin wrote:

> Hello
>
> I seem to have a bit of a problem. In my vhost's server {}; block, I have:
>
> ssl_ciphers
> EECDH+aRSA+AESGCM:EECDH+aRSA+AES:EDH+aRSA+AESGCM:EDH+aRSA+AES:DES-CBC3-SHA:!EXP:!CAMELLIA:!DSS:!MEDIUM:!LOW:!aNULL:!eNULL:!RC4;
> ssl_prefer_server_ciphers on;
>
> but for some reason this doesn't seem to be respected because ssllabs.com's
> checker says:
>
> "RC4 cipher is used with TLS 1.1 or newer protocols, even though stronger
> ciphers are available."
>
> Testing with openssl s_client shows:
>
> SSL-Session:
> Protocol : TLSv1.2
> Cipher : ECDHE-RSA-RC4-SHA
>
> My ssl_ciphers line _should_ be disallowing all RC4... so I am not sure if
> this is a bug or if I have these options in the wrong place (I tried them
> in the http{} block for grins with no effect) or if there's something
> missing from my build. Can someone provide guidance?

Configuring ssl_ciphers at http{} level should be fine - as long
as it's not overwritten in server{} blocks.

Some thrivial things to check:

- make sure ssl_ciphers isn't overwritten in server{} blocks;

- make sure you've properly reloaded you configuration. If you
used configuration reload (not nginx restart) - make sure to
check logs to see if reload went fine, as nginx will revert to a
previous configuration in case of errors. Additionally, "nginx -t"
may be helpful here.

- make sure you are testing correct server.

--
Maxim Dounin
http://nginx.org/

_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx