ssl_protocols directive in server { } doesn't work

[Erictoby@…]

"ssl_protocols" could be located either in http { } or in server { } in /etc/nginx/nginx.conf. It, however, doesn't work anymore in server { }.

version 1.19.4 : work either in http { } or in server { }
version 1.20.2 : only work in http { }
version 1.21.5 : only work in http { }

Example)

http {
    ssl_protocols TLSv1.1 TLSv1.2;
    server {
        ssl_protocols TLSv1.2 TLSv1.3;
    }
}

==> TLS 1.1 & TLS 1.2 work, but TLS 1.3 doesn't work.

http {
    server {
        ssl_protocols TLSv1.2 TLSv1.3;
    }
}

==> TLS 1.2 work, but TLS 1.3 doesn't work.

http {
    ssl_protocols TLSv1.2 TLSv1.3;
    server {
    }
}

==> TLS 1.2 & TLS 1.3 work;

[Maxim Dounin]

Could you please show exact self-contained configuration which demonstrate the problem? Depending on the exact configuration, most like it is either duplicate of #676 (ssl_protocols cannot be used in name-based virtual servers, configuration from the default server applies) or #2071 (due to a bug OpenSSL disables TLSv1.3 if no certificates are specified in the default server block, fixed in OpenSSL 1.1.1j).

[Erictoby@…]

I was confused because it didn't work since I upgraded nginx to 1.20.2(or 1.21.5-quic in other server) from 1.19.4 with all the *.conf same. But, I found it's already discussed in the ticket #2101, #2071 (thanks Maxim).

ssl_protocols should be in http{} or in server{} with "default_server" since 1.19.6+.

Now, I did quick test again with 1.21.5 with BoringSSL(current version as of today). Result: ssl_protocols in default server{} block works. ssl_protocols in non-default server{} block doesn't work.

If this is the permanent case, updating the documentation may help us. For example, ​http://nginx.org/en/docs/http/configuring_https_servers.html.

Thanks.

[Maxim Dounin]

ssl_protocols should be in http{} or in server{} with "default_server" since 1.19.6+

That's not something "since 1.19.6+", that's how it always worked, regardless of nginx version: things which are set up before the server name is known can be only configured in default servers, and not pure virtual ones. And this equally applies to ssl_protocols in all nginx version. Details are explained in ticket #676 and linked mailing list thread.

If you are seeing a change in 1.19.6, the most likely reason is that the configuration is actually changed and in the default server you are using ssl_reject_handshake without any certificates. This might be something happened silently due to changes in default configuration files provided by the nginx package you are using.

As previously explained, this is a bug in OpenSSL which disables TLSv1.3 if there are no certificates configured. The bug is fixed in OpenSSL 1.1.1j. In the buggy OpenSSL version you are using it can be worked around by using a dummy certificate in the default server.

Closing this as a duplicate of #2071.