[Pkg-nginx-maintainers] Bug#944006: nginx-extras missing TLS1.3

[Thomas Ward]

Can you include the output of `nginx -V` please as well?  Part of TLS 
support is having a version of NGINX that is compiled against an OpenSSL 
in the repositories for the version of Debian you're using which 
supports TLS1.3, but that may not be the case in all releases of Debian.


Thomas


On 11/2/19 1:15 PM, Florent CARRÉ wrote:
> Package: nginx-extras
> Version: 1.14.2-2+deb10u1
>
> When I modify to have exclusively TLS1.2 and TLS1.3, just TLS1.2 is available.
>
> Steps to reproduce :
> - switch to ssl_protocols TLSv1.2 TLSv1.3
> - restart nginx
> - curl -v --tlsv1.3 mydomain.com
>
> I obtain :
> * TLSv1.3 (OUT), TLS handshake, Client hello (1):
> * TLSv1.3 (IN), TLS alert, protocol version (582):
> * error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version
> * Closing connection 0
> curl: (35) error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert
> protocol version
>
> And it's available in openssl : openssl ciphers -v | grep " TLSv1\.3 "
> TLS_AES_256_GCM_SHA384  TLSv1.3 Kx=any      Au=any  Enc=AESGCM(256) Mac=AEAD
> TLS_CHACHA20_POLY1305_SHA256 TLSv1.3 Kx=any      Au=any
> Enc=CHACHA20/POLY1305(256) Mac=AEAD
> TLS_AES_128_GCM_SHA256  TLSv1.3 Kx=any      Au=any  Enc=AESGCM(128) Mac=AEAD
>
> Regards
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-nginx-maintainers/attachments/20191105/61904f2a/attachment.html>