<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Can you include the output of `nginx -V` please as well? Part of
TLS support is having a version of NGINX that is compiled against
an OpenSSL in the repositories for the version of Debian you're
using which supports TLS1.3, but that may not be the case in all
releases of Debian.</p>
<p><br>
</p>
<p>Thomas</p>
<p><br>
</p>
<div class="moz-cite-prefix">On 11/2/19 1:15 PM, Florent CARRÉ
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAM74x=JDHmH=fXTLnpEMXCFHPXKf9VQ2mdc1t5OB7YAe8DVgfA@mail.gmail.com">
<pre class="moz-quote-pre" wrap="">Package: nginx-extras
Version: 1.14.2-2+deb10u1
When I modify to have exclusively TLS1.2 and TLS1.3, just TLS1.2 is available.
Steps to reproduce :
- switch to ssl_protocols TLSv1.2 TLSv1.3
- restart nginx
- curl -v --tlsv1.3 mydomain.com
I obtain :
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS alert, protocol version (582):
* error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version
* Closing connection 0
curl: (35) error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert
protocol version
And it's available in openssl : openssl ciphers -v | grep " TLSv1\.3 "
TLS_AES_256_GCM_SHA384 TLSv1.3 Kx=any Au=any Enc=AESGCM(256) Mac=AEAD
TLS_CHACHA20_POLY1305_SHA256 TLSv1.3 Kx=any Au=any
Enc=CHACHA20/POLY1305(256) Mac=AEAD
TLS_AES_128_GCM_SHA256 TLSv1.3 Kx=any Au=any Enc=AESGCM(128) Mac=AEAD
Regards
</pre>
</blockquote>
</body>
</html>