webzod
account

Disable the RC4 cipher on nginx

tls.ciphers.rc4 · effort: minutes

Why it matters

RC4 is a broken cipher that attackers can use to recover encrypted data, and it has been banned from TLS since 2015. No current browser needs it.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. Find every existing setting with grep -Rn -E 'ssl_protocols|ssl_ciphers' /etc/nginx /etc/letsencrypt. nginx merges repeated ssl_protocols lines, and a server-level line (including certbot's options-ssl-nginx.conf) overrides http, so edit each existing line and replace the ssl_ciphers value instead of adding a second line, which is an error.
  2. Test with nginx -t, reload, and check the result with the nmap command from the generic entry.
/etc/nginx/nginx.conf 
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.