webzod
account

Enable TLS 1.2 and TLS 1.3 on nginx

tls.protocols.no_modern · effort: a project

Why it matters

The server accepts neither TLS 1.2 nor TLS 1.3, so current browsers cannot connect securely or at all. The software behind it is typically years out of date.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. Check the build with nginx -V, which prints the OpenSSL version it was built against. Install an nginx package built against OpenSSL 1.1.1 or later.
  2. Find every existing line with grep -Rn ssl_protocols /etc/nginx /etc/letsencrypt. A server-level line (including certbot's options-ssl-nginx.conf) overrides http, so edit each one.
  3. Set the protocols, test the configuration and reload.
/etc/nginx/nginx.conf 
ssl_protocols TLSv1.2 TLSv1.3;

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.