TSv1.3 don't work on Fedora 37 and Nginx 1.22.1

Ask Fedora
,
1

Hi,

I have an issue with Nginx. I have activated TLSv1.3 in my config (see above) but my client cannot use that.

My config :

nginx.conf :

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log error;
pid /run/nginx.pid;

# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}

stream {
  server {
    listen 22;
    proxy_pass 10.9.0.235:22;
  }
}


http {
  log_format main '$remote_addr - $remote_user [$time_local] '
                  '"$request_method $scheme://$host $server_protocol $ssl_protocol/$ssl_cipher" $status $body_bytes_sent '
                  '"$http_referer" "$http_user_agent"';
    
    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    keepalive_timeout   65;
    types_hash_max_size 4096;
    charset utf-8;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

     server_tokens off;

    # Load modular configuration files from the /etc/nginx/conf.d directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.
    include /etc/nginx/conf.d/compression.conf;
    include /etc/nginx/sites-enabled/*.conf;

compression.conf :

gzip on;
gzip_min_length 500;
gzip_buffers 4 8k;
gzip_types text/plain text/css text/javascript application/javascript application/x-javascript;
gzip_vary on;

sites-enabled/test.conf

server {
# HTTPS server config
  listen 443 ssl http2;
  server_name test.[redacted];

# TLS certificates
  ssl_certificate /var/lib/nginx/.acme.sh/[redacted]/fullchain.cer;
  ssl_certificate_key /var/lib/nginx/.acme.sh/[redacted]/[redacted].key;
  ssl_protocols TLSv1.3;

  location / {
    return 200 "Work";
    add_header content-type "text/plain";
  }

Firefox, curl and openssl cannot use TLSv1.3, only TLSv1.2 work. ssl_protocols TLSv1.3; Seem ignored.

Nginx version :

nginx version: nginx/1.22.1
built with OpenSSL 3.0.5 5 Jul 2022
TLS SNI support enabled
configure arguments: --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-compat --with-debug --with-file-aio --with-google_perftools_module --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_degradation_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_image_filter_module=dynamic --with-http_mp4_module --with-http_perl_module=dynamic --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-http_xslt_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-openssl-opt=enable-ktls --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-threads --with-cc-opt='-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection' --with-ld-opt='-Wl,-z,relro -Wl,--as-needed -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -Wl,--build-id=sha1 -specs=/usr/lib/rpm/redhat/redhat-package-notes -W```
2

I found the problem. The ssl related parameters seem to have to be included in the http block.

1 Like