webzod
account

Disable the 3DES cipher on nginx

tls.ciphers.3des · effort: minutes

Why it matters

3DES uses a small block size that lets attackers recover data from long connections (the Sweet32 attack), and it is weaker than the 128-bit minimum used today. Current browsers and clients do not need it.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. Find every existing setting with grep -Rn -E 'ssl_protocols|ssl_ciphers' /etc/nginx /etc/letsencrypt. nginx merges repeated ssl_protocols lines, and a server-level line (including certbot's options-ssl-nginx.conf) overrides http, so edit each existing line and replace the ssl_ciphers value instead of adding a second line, which is an error.
  2. Test with nginx -t, reload, and check with the nmap command from the generic entry.
/etc/nginx/nginx.conf 
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.