0

I'd checked a lot manuals, and performed recomendation settings for nginx ssl setup (How do you score A+ with 100 on all categories on SSL Labs test with Let's Encrypt and Nginx?), but still ssllab's rating is B: https://www.ssllabs.com/ssltest/analyze.html?d=remo24.ru

Nginx: 1.12.1 Openssl: 1.0.1t My nginx conf files:

nginx.conf

http {
    include       /etc/nginx/mime.types;

## Start add by hoster support
    proxy_read_timeout 500;
    proxy_connect_timeout 500;
    client_max_body_size 100M;
    server_names_hash_bucket_size 64;
## End add by hoster support

#My ssl config
    ssl_session_tickets off;
 ...

ssl.conf

ssl_protocols TLSv1.2 TLSv1.1 TLSv1
ssl_ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS; # Score=90 (recommended)

ssl_prefer_server_ciphers on;

sites-enabled/{hostname}.conf

server { listen {server_ip}:443 ssl;

server_name {hostname};

ssl on;

ssl_stapling on;
ssl_stapling_verify on;

ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_ecdh_curve secp384r1;

resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 10s;

add_header Strict-Transport-Security max-age=31536000;      

ssl_certificate     /etc/nginx/ssl/{hostname}/chain.crt;
ssl_certificate_key /etc/nginx/ssl/{hostname}/cert.key;
ssl_dhparam /etc/nginx/ssl/{hostname}/dhparam.pem;

What's wrong? What should I check for?

eurobax
  • 3
  • 2

1 Answers1

0

I can't beleive, the answer is simple: I'd forgotten to include nginx ssl config manually in /sites-enabled config for my domain!

   server{
     ssl on;
     ...
        #Include global SSL settings
        include /etc/nginx/ssl.conf;
     ...
eurobax
  • 3
  • 2