webzod
account

Turn off TLS 1.0 and 1.1 on nginx

tls.protocols.legacy_enabled · effort: minutes

Why it matters

TLS 1.0 and 1.1 are deprecated and no current browser uses them, but leaving them on lets attackers and old tools negotiate weaker encryption. Turning them off costs almost nothing today.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. Find every existing setting with the grep command below. nginx merges repeated ssl_protocols lines, so a leftover legacy line stays active, and a server-level line (including the one in certbot's options-ssl-nginx.conf) overrides the http-level one. Edit each existing line instead of adding another.
  2. Set the list in http { } or in each server block that already sets it, and make sure every server block that listens on 443 ends up with only TLSv1.2 and TLSv1.3.
  3. Check the configuration, then reload.
/etc/nginx/nginx.conf 
# find existing settings
#   grep -Rn -E 'ssl_protocols|ssl_ciphers' /etc/nginx /etc/letsencrypt
# inside http { }, or in each server block that already sets it
ssl_protocols TLSv1.2 TLSv1.3;

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.