Changing NGINX to only use TLS1.2

[Martin Andersson]

Hello!

The latest update of 11.5.30 has broken my custom NGINX settings which allowed only TLS1.2. My sites are now using SSLV3 and TLSV1 only. For the life of me, I can't figure out where to change this back. All my NGINX configuration files seem to be correct under /etc/nginx/plesk.conf.d/ -- what am I missing?

Many thanks,

Martin

 

[InderS]

Try to chnage your site nginx setting with the "ssl_protocols -- SSLv3 TLSv1 TLSv1.1 TLSv1.2"

Check this : http://nginx.org/en/docs/http/configuring_https_servers.html

 

[Martin Andersson]

Try to chnage your site nginx setting with the "ssl_protocols -- SSLv3 TLSv1 TLSv1.1 TLSv1.2"

Check this : http://nginx.org/en/docs/http/configuring_https_servers.html

Thanks for your feedback. I have already done this, and re-checked the configuration files since the latest update. Everything looks fine with the line:

ssl_protocols TLSv1.2;

I assume I'm just being daft and missing something. I know updates break custom settings, but I just can't see any configuration file which shows:

ssl_protocols SSLv3 TLSv1;

Which are the currently enabled protocols since the last update. TLSv1.2 is still working for the Plesk admin panel.

Martin

 

[Martin Andersson]

Thanks for your feedback. I have already done this, and re-checked the configuration files since the latest update. Everything looks fine with the line:

ssl_protocols TLSv1.2;

I assume I'm just being daft and missing something. I know updates break custom settings, but I just can't see any configuration file which shows:

ssl_protocols SSLv3 TLSv1;

Which are the currently enabled protocols since the last update. TLSv1.2 is still working for the Plesk admin panel.

Martin

To make it more interesting, I just created a new webspace and it has the correct SSL settings. I have tried running:

/usr/local/psa/admin/sbin/httpdmng --reconfigure-all

But hasn't changed the problem for any webspace that was enabled during the last update....

/M

 

[MoritzK]

Has anyone found a solution by now?

 

[MoritzK]

I found a solution to enable TLS 1.1 and TLS 1.2 by my self.

You have to modify the two PHP files:
usr/local/psa/admin/conf/templetes/default/nginxWebmailPartial.php
usr/local/psa/admin/conf/templetes/default/domain/nginxDomainVirtualHost.php

ssl_protocols             SSLv3 TLSv1 [B]TLSv1.1 TLSv1.2[/B];

webmail.* and all domains using nginx support TLS 1.1 and TLS 1.2 now.

(http://forum.parallels.com/showthread.php?300627-nginx-reverse-proxy-with-TLSv1-1-and-TLSv1-2)