Different ssl_protocols per server won`t work

[Roman Pavlík]

I configured Nginx for two TLS virtualhost 'example.one' and 'example.two' with two different certficates.

I need to setup TLS1.0+ for the first one and only TLS1.2 for the second one. However the second one (example.two) configuration ignores ssl_protocols directive and takes ssl_procolols from first server directive.

So both server directive uses the first configured ssl_protocols directive.

server {
    listen          443 default_server ssl spdy;
    server_name     example.one;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

    ssl_certificate         /certs/cert-for-example.one.pem;
    ssl_certificate_key     /certs/privkey-for-example.one.pem;


    # another ssl_* directives ...
}

server {
    listen          443 ssl spdy;
    server_name     example.two;

    ssl_protocols TLSv1.2;

    ssl_certificate         /certs/cert-for-example.two.pem;
    ssl_certificate_key     /certs/privkey-for-example.two.pem;

    # another ssl_* directives ...
}

I don't want to use SSL3 so the TLS SNI should work fine and I believe Nginx can decide which ssl_protocols directive to use based on server name provided in client Hello packet.

[Maxim Dounin]

This is per OpenSSL behaviour, and there isn't much nginx can do to fix this. See detailed explanation and previous discussion ​in this thread.

[norstbox@…]

As a workaround, there are a possible to restrict TLS protocol version using "ssl_ciphers" directive. Supplying TLSv1.2 specific cipher suites will effectively prevent handshake for lower TLS versions. So, for above example,

ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256';

instead "ssl_protocols TLSv1.2;" will do the trick.

[Maxim Dounin]

See also #844.

[Maxim Dounin]

See also #1948.

[Maxim Dounin]

See also #1967, #1968.