Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Enable older ciphers AES128-GCM-SHA256/AES256-GCM-SHA384 #893

Closed
ivanvaccari opened this issue May 22, 2024 · 6 comments
Closed

Enable older ciphers AES128-GCM-SHA256/AES256-GCM-SHA384 #893

ivanvaccari opened this issue May 22, 2024 · 6 comments

Comments

@ivanvaccari
Copy link

ivanvaccari commented May 22, 2024 •
edited
Loading

Describe the bug

Not really a bug, but a help request.
I'm reporting here the problem i'm facing to enable older ciphers in a modern nginx deployment.
The original problem was posted on the nginx-derived image repository: JonasAlfredsson/docker-nginx-certbot#247

Short description: i need to enable AES128-GCM-SHA256 or AES256-GCM-SHA384, but all tentatives have failed so far.
What i tried:

  • Added the ciphers to ssl_ciphers and added ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3. System still enables only TLS1.2
  • Launched the image with "DEBUG=1", no relevant log displayed
  • Changed SECLEVEL=0 in openssl.cnf

For any change i've ever applied QUALYS ssl test tool never shows the wanted ciphers, although changes on other cipers are reflected in the detected list.

Also trying a connection with openssl s_client -cipher AES128-GCM-SHA256 -connect HIDDEN:443 -tls1_2 fails.

Am i missing some important point?

Your environment

  • nginx 1.25.4
  • openssl 3.0.11
  • Docker compose

Additional context

More discussions and tentatives here: JonasAlfredsson/docker-nginx-certbot#247
@oxpa
Copy link
Collaborator

oxpa commented May 22, 2024

Hello Ivan,

To say it simply, nginx doesn't really do anything with cryptography stuff. Most of the work is done by openssl.
To make it easier to diagnose, could you please post:

  • all ssl configuration options set in your configuration (for all server blocks as connection may land into an unexpected one)
  • openssl ciphers -v output from the box
  • openssl x509 -in $cert -noout -text output (stripping subject and subject alt name, probably)
  • and, finally, openssl s_client ... output as well

@ivanvaccari
Copy link
Author

nginx.conf

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
        worker_connections 768;
        # multi_accept on;
}

http {

        ##
        # Basic Settings
        ##

        sendfile on;
        tcp_nopush on;
        tcp_nodelay on;
        keepalive_timeout 65;
        types_hash_max_size 2048;
        # server_tokens off;

        # server_names_hash_bucket_size 64;
        # server_name_in_redirect off;
        client_max_body_size 16M;

        include /etc/nginx/mime.types;
        default_type application/octet-stream;

        ##
        # SSL Settings. See https://ssl-config.mozilla.org/#server=nginx
        ##
        proxy_ssl_server_name off;
        ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
        ssl_prefer_server_ciphers on;
        ssl_ciphers AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
        ssl_session_cache off;
        ssl_session_timeout 10s;
        ssl_session_tickets off;

        ##
        # Logging Settings
        access_log /var/log/nginx/access.log;
        error_log /var/log/nginx/error.log debug;

        ##
        # Gzip Settings
        ##
        gzip on;

        # gzip_vary on;
        # gzip_proxied any;
        # gzip_comp_level 6;
        # gzip_buffers 16 8k;
        # gzip_http_version 1.1;
        # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

        ##
        # Virtual Host Configs
        ##
        include /etc/nginx/conf.d/*.conf;
        include /etc/nginx/sites-enabled/*;
}

Relevant section of conf.d/default

server {

    server_name HIDDEN;

    # maintenance mode
    error_page 503 /var/www/maintenance/error503.html;
    location /var/www/maintenance/error503.html {
        alias /var/www/maintenance/error503.html;
    }


    # web server
    location / {

        # maintenance mode
        if (-f /etc/nginx/maintenancemode/maintmode$geo_host) {
            return 503;
        }

        proxy_pass http://onit-prodocu:3000/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        # dont cache anything
        proxy_cache off;
    }


    listen [::]:443 ssl ipv6only=on;
    listen 443 ssl;
    ssl_certificate /etc/letsencrypt/live/CERTNAME/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/CERTNAME/privkey.pem;
    ssl_dhparam /etc/letsencrypt/dhparams/ssl-dhparams.pem;

}

openssl ciphers -v

TLS_AES_256_GCM_SHA384         TLSv1.3 Kx=any      Au=any   Enc=AESGCM(256)            Mac=AEAD
TLS_CHACHA20_POLY1305_SHA256   TLSv1.3 Kx=any      Au=any   Enc=CHACHA20/POLY1305(256) Mac=AEAD
TLS_AES_128_GCM_SHA256         TLSv1.3 Kx=any      Au=any   Enc=AESGCM(128)            Mac=AEAD
ECDHE-ECDSA-AES256-GCM-SHA384  TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(256)            Mac=AEAD
ECDHE-RSA-AES256-GCM-SHA384    TLSv1.2 Kx=ECDH     Au=RSA   Enc=AESGCM(256)            Mac=AEAD
DHE-RSA-AES256-GCM-SHA384      TLSv1.2 Kx=DH       Au=RSA   Enc=AESGCM(256)            Mac=AEAD
ECDHE-ECDSA-CHACHA20-POLY1305  TLSv1.2 Kx=ECDH     Au=ECDSA Enc=CHACHA20/POLY1305(256) Mac=AEAD
ECDHE-RSA-CHACHA20-POLY1305    TLSv1.2 Kx=ECDH     Au=RSA   Enc=CHACHA20/POLY1305(256) Mac=AEAD
DHE-RSA-CHACHA20-POLY1305      TLSv1.2 Kx=DH       Au=RSA   Enc=CHACHA20/POLY1305(256) Mac=AEAD
ECDHE-ECDSA-AES128-GCM-SHA256  TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(128)            Mac=AEAD
ECDHE-RSA-AES128-GCM-SHA256    TLSv1.2 Kx=ECDH     Au=RSA   Enc=AESGCM(128)            Mac=AEAD
DHE-RSA-AES128-GCM-SHA256      TLSv1.2 Kx=DH       Au=RSA   Enc=AESGCM(128)            Mac=AEAD
ECDHE-ECDSA-AES256-SHA384      TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AES(256)               Mac=SHA384
ECDHE-RSA-AES256-SHA384        TLSv1.2 Kx=ECDH     Au=RSA   Enc=AES(256)               Mac=SHA384
DHE-RSA-AES256-SHA256          TLSv1.2 Kx=DH       Au=RSA   Enc=AES(256)               Mac=SHA256
ECDHE-ECDSA-AES128-SHA256      TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AES(128)               Mac=SHA256
ECDHE-RSA-AES128-SHA256        TLSv1.2 Kx=ECDH     Au=RSA   Enc=AES(128)               Mac=SHA256
DHE-RSA-AES128-SHA256          TLSv1.2 Kx=DH       Au=RSA   Enc=AES(128)               Mac=SHA256
ECDHE-ECDSA-AES256-SHA         TLSv1   Kx=ECDH     Au=ECDSA Enc=AES(256)               Mac=SHA1
ECDHE-RSA-AES256-SHA           TLSv1   Kx=ECDH     Au=RSA   Enc=AES(256)               Mac=SHA1
DHE-RSA-AES256-SHA             SSLv3   Kx=DH       Au=RSA   Enc=AES(256)               Mac=SHA1
ECDHE-ECDSA-AES128-SHA         TLSv1   Kx=ECDH     Au=ECDSA Enc=AES(128)               Mac=SHA1
ECDHE-RSA-AES128-SHA           TLSv1   Kx=ECDH     Au=RSA   Enc=AES(128)               Mac=SHA1
DHE-RSA-AES128-SHA             SSLv3   Kx=DH       Au=RSA   Enc=AES(128)               Mac=SHA1
RSA-PSK-AES256-GCM-SHA384      TLSv1.2 Kx=RSAPSK   Au=RSA   Enc=AESGCM(256)            Mac=AEAD
DHE-PSK-AES256-GCM-SHA384      TLSv1.2 Kx=DHEPSK   Au=PSK   Enc=AESGCM(256)            Mac=AEAD
RSA-PSK-CHACHA20-POLY1305      TLSv1.2 Kx=RSAPSK   Au=RSA   Enc=CHACHA20/POLY1305(256) Mac=AEAD
DHE-PSK-CHACHA20-POLY1305      TLSv1.2 Kx=DHEPSK   Au=PSK   Enc=CHACHA20/POLY1305(256) Mac=AEAD
ECDHE-PSK-CHACHA20-POLY1305    TLSv1.2 Kx=ECDHEPSK Au=PSK   Enc=CHACHA20/POLY1305(256) Mac=AEAD
AES256-GCM-SHA384              TLSv1.2 Kx=RSA      Au=RSA   Enc=AESGCM(256)            Mac=AEAD
PSK-AES256-GCM-SHA384          TLSv1.2 Kx=PSK      Au=PSK   Enc=AESGCM(256)            Mac=AEAD
PSK-CHACHA20-POLY1305          TLSv1.2 Kx=PSK      Au=PSK   Enc=CHACHA20/POLY1305(256) Mac=AEAD
RSA-PSK-AES128-GCM-SHA256      TLSv1.2 Kx=RSAPSK   Au=RSA   Enc=AESGCM(128)            Mac=AEAD
DHE-PSK-AES128-GCM-SHA256      TLSv1.2 Kx=DHEPSK   Au=PSK   Enc=AESGCM(128)            Mac=AEAD
AES128-GCM-SHA256              TLSv1.2 Kx=RSA      Au=RSA   Enc=AESGCM(128)            Mac=AEAD
PSK-AES128-GCM-SHA256          TLSv1.2 Kx=PSK      Au=PSK   Enc=AESGCM(128)            Mac=AEAD
AES256-SHA256                  TLSv1.2 Kx=RSA      Au=RSA   Enc=AES(256)               Mac=SHA256
AES128-SHA256                  TLSv1.2 Kx=RSA      Au=RSA   Enc=AES(128)               Mac=SHA256
ECDHE-PSK-AES256-CBC-SHA384    TLSv1   Kx=ECDHEPSK Au=PSK   Enc=AES(256)               Mac=SHA384
ECDHE-PSK-AES256-CBC-SHA       TLSv1   Kx=ECDHEPSK Au=PSK   Enc=AES(256)               Mac=SHA1
SRP-RSA-AES-256-CBC-SHA        SSLv3   Kx=SRP      Au=RSA   Enc=AES(256)               Mac=SHA1
SRP-AES-256-CBC-SHA            SSLv3   Kx=SRP      Au=SRP   Enc=AES(256)               Mac=SHA1
RSA-PSK-AES256-CBC-SHA384      TLSv1   Kx=RSAPSK   Au=RSA   Enc=AES(256)               Mac=SHA384
DHE-PSK-AES256-CBC-SHA384      TLSv1   Kx=DHEPSK   Au=PSK   Enc=AES(256)               Mac=SHA384
RSA-PSK-AES256-CBC-SHA         SSLv3   Kx=RSAPSK   Au=RSA   Enc=AES(256)               Mac=SHA1
DHE-PSK-AES256-CBC-SHA         SSLv3   Kx=DHEPSK   Au=PSK   Enc=AES(256)               Mac=SHA1
AES256-SHA                     SSLv3   Kx=RSA      Au=RSA   Enc=AES(256)               Mac=SHA1
PSK-AES256-CBC-SHA384          TLSv1   Kx=PSK      Au=PSK   Enc=AES(256)               Mac=SHA384
PSK-AES256-CBC-SHA             SSLv3   Kx=PSK      Au=PSK   Enc=AES(256)               Mac=SHA1
ECDHE-PSK-AES128-CBC-SHA256    TLSv1   Kx=ECDHEPSK Au=PSK   Enc=AES(128)               Mac=SHA256
ECDHE-PSK-AES128-CBC-SHA       TLSv1   Kx=ECDHEPSK Au=PSK   Enc=AES(128)               Mac=SHA1
SRP-RSA-AES-128-CBC-SHA        SSLv3   Kx=SRP      Au=RSA   Enc=AES(128)               Mac=SHA1
SRP-AES-128-CBC-SHA            SSLv3   Kx=SRP      Au=SRP   Enc=AES(128)               Mac=SHA1
RSA-PSK-AES128-CBC-SHA256      TLSv1   Kx=RSAPSK   Au=RSA   Enc=AES(128)               Mac=SHA256
DHE-PSK-AES128-CBC-SHA256      TLSv1   Kx=DHEPSK   Au=PSK   Enc=AES(128)               Mac=SHA256
RSA-PSK-AES128-CBC-SHA         SSLv3   Kx=RSAPSK   Au=RSA   Enc=AES(128)               Mac=SHA1
DHE-PSK-AES128-CBC-SHA         SSLv3   Kx=DHEPSK   Au=PSK   Enc=AES(128)               Mac=SHA1
AES128-SHA                     SSLv3   Kx=RSA      Au=RSA   Enc=AES(128)               Mac=SHA1
PSK-AES128-CBC-SHA256          TLSv1   Kx=PSK      Au=PSK   Enc=AES(128)               Mac=SHA256
PSK-AES128-CBC-SHA             SSLv3   Kx=PSK      Au=PSK   Enc=AES(128)               Mac=SHA1

openssl x509 -in $cert -noout -text

Hashes stripped out. Certificate generated via certbot

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:.............15
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Let's Encrypt, CN = R3
        Validity
            Not Before: May 13 07:24:59 2024 GMT
            Not After : Aug 11 07:24:58 2024 GMT
        Subject: CN = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub:
                    04:....................:40
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Subject Key Identifier:
                1E:.................:D4
            X509v3 Authority Key Identifier:
                14:.............:C6
            Authority Information Access:
                OCSP - URI:http://r3.o.lencr.org
                CA Issuers - URI:http://r3.i.lencr.org/
            X509v3 Subject Alternative Name:
                DNS:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
            CT Precertificate SCTs:
                Signed Certificate Timestamp:
                    Version   : v1 (0x0)
                    Log ID    : 48..........73
                    Timestamp : May 13 08:24:59.396 2024 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30........62
                Signed Certificate Timestamp:
                    Version   : v1 (0x0)
                    Log ID    : DF..............5C
                    Timestamp : May 13 08:24:59.581 2024 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30............CA
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        9a............26

openssl s_client -cipher AES128-GCM-SHA256 -connect HIDDEN:443 -tls1_2

Done via git-bash on windows

CONNECTED(000001A8)
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 178 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1715843593
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
---
18260:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:../openssl-1.1.1q/ssl/record/rec_layer_s3.c:1543:SSL alert number 40

ssllabs.com

image

@oxpa
Copy link
Collaborator

oxpa commented May 22, 2024 •
edited
Loading

I have to admit here, I'm not a real crypto specialist :)

As you can spot in the output, AES128-GCM-SHA256 expects to have RSA key ( I think RSA is abbreviated from the name of the cipher but can't find this note in a manual page straight away):

AES128-GCM-SHA256              TLSv1.2 Kx=RSA      Au=RSA   Enc=AESGCM(128)            Mac=AEAD

But you have only EC key and cert. So the selected cipher simply doesn't match the key you have.
This is also highlighted by the SSL Labs test where you only have ECDH listed.

You can configure both RSA and EC ssl certs in a single server block and nginx will use appropriate one for a connection.

@ivanvaccari
Copy link
Author

I have to admit here, I'm not a real crypto specialist :)

Absolutely me neither!

I was noticing after your suggestion about RSA this:

sslabs.com says the key is "EC 256 bits"
image

while on another server (where coincidently ciphers are enabled), instantiated probably some 3 years ago, which uses direcly nginx and certbot (not via docker), displays a different value:

image

It might just be sufficient to regenerate the certificate using --key-type rsa?

@oxpa
Copy link
Collaborator

oxpa commented May 22, 2024

I'm not sure how it done with certbot: personally, I use acme.sh for my projects (with dns-01 challenge). I request two types of certs: EC and RSA, configuring both of them in nginx so that nginx could use either one of them when needed.
Additionally, I don't regenerate keys every time: I keep keys in place and distribute updated certificates through a configuration management system.

In general though, yes, regenerating cert with RSA type should help. But I'd recommend having two certs of different types configured.

And, as we sorted out the nginx part, I will the issue=)
Cheers!

@oxpa oxpa closed this as completed May 22, 2024
@ivanvaccari ivanvaccari mentioned this issue May 24, 2024
Closed
@ivanvaccari
Copy link
Author

Regenerating the certificate with --key-type rsa makes the required ciphers to be enabled!.

I'm not investigating now the dual-cerificate suggestion for lack of time, but will definitely do it sooner or later.

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@oxpa @ivanvaccari