Commit f810bd6b authored by nimrod's avatar nimrod
Browse files

SSL legacy support. 

Up to now I supported older browsers by supporting older versions of TLS
and cipher suites. I still think it makes sense for my blog, etc. but
not for Nextcloud or GitLab. So here's the first step, make the previous
default SSL configuration be ssl-legacy (split out the common parts to
ssl-common) and next is ssl-modern.
parent 28413e0e

conf.d/default.conf

+1 −1
Original line number Diff line number Diff line
@@ -8,6 +8,6 @@ server { 
server {

    listen      443 ssl http2 default_server;

    listen      [::]:443 ssl http2 default_server;

    include     snippets/ssl.conf;

    include     snippets/ssl-legacy.conf;

    location    / { return 301 https://www.shore.co.il$request_uri; }

}

snippets/ssl.conf→snippets/ssl-common.conf

+0 −2
Original line number Diff line number Diff line
@@ -4,8 +4,6 @@ include snippets/common-headers.conf; 
ssl_certificate             /var/ssl/site.crt;

ssl_certificate_key         /var/ssl/site.key;

ssl_dhparam                 /var/ssl/dhparams;

ssl_protocols               TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;

ssl_ciphers                 !AESCCM:!kRSA:!3DES:!RC4:!DES:!MD5:!aNULL:!NULL:AESGCM+ECDH:ECDH+CHACHA20:AES256+ECDH:AES128:CHACHA20:+SHA1;

ssl_prefer_server_ciphers   on;

ssl_session_cache           shared:SSL:50m;

ssl_session_timeout         5m;

snippets/ssl-legacy.conf

0 → 100644
+3 −0
Original line number Diff line number Diff line 
include                     snippets/ssl-common.conf;

ssl_protocols               TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;

ssl_ciphers                 !AESCCM:!kRSA:!3DES:!RC4:!DES:!MD5:!aNULL:!NULL:AESGCM+ECDH:ECDH+CHACHA20:AES256+ECDH:AES128:CHACHA20:+SHA1;