webzod
account

Require forward-secret ciphers on nginx

tls.ciphers.no_forward_secrecy · effort: minutes

Why it matters

The server accepts ciphers where one stolen private key can decrypt all recorded past traffic. Forward-secret ciphers (ECDHE) are supported by every current client.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. Find every existing setting with grep -Rn -E 'ssl_protocols|ssl_ciphers' /etc/nginx /etc/letsencrypt. nginx merges repeated ssl_protocols lines, and a server-level line (including certbot's options-ssl-nginx.conf) overrides http, so edit each existing line. Replace the ssl_ciphers value instead of adding a second line, which is an error, and keep TLS 1.2 and 1.3 enabled.
  2. Test with nginx -t and reload.
  3. Keep the previous lines commented out beside the new ones, so you can roll back by restoring them and reloading if a client you need breaks.
/etc/nginx/nginx.conf 
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.