Skip to content

4512-nginx-header-tls - It Is Recommended to Use Only Modern TLS Protocols

Rule ID

  • 4512-nginx-header-tls

Category

  • nginx

Level

  • info

Compatible Versions

  • Linux

Description

  • For all client connections and upstream connections, only modern TLS protocols should be enabled in NGINX. Removing legacy TLS and SSL protocols (SSL3.0, TLS1.0, and TLS1.1) and enabling the emerging and stable TLS protocol (TLS1.2) ensures that users can leverage strong security features and protect against insecure legacy protocols.

Scan Frequency

  • 0 */30 * * *

Rationale

  • Why disable SSL3.0: The POODLE vulnerability allows attackers to exploit CBC vulnerabilities in SSL3.0 to obtain plaintext information. SSL3.0 also no longer complies with the FIPS 140-2 standard.

  • Why disable TLS1.0: When PCI DSS compliance requires that it not be used for any application processing credit card numbers, TLS1.0 is prohibited. TLS1.0 does not use modern protection features, and almost all user agents that do not support TLS1.2 or later are no longer supported by their vendors.

  • Why disable TLS1.1: TLS1.0 should be disabled due to the increased security associated with higher TLS versions. Modern browsers began marking TLS1.1 as insecure starting in early 2019.

  • Why enable TLS1.2: TLS1.2 leverages several security features, including modern cipher suites, perfect forward secrecy, and authenticated encryption.

Risk Items

  • nginx security

Audit Method

  • Run the following command to verify:
grep -ir ssl_protocol /etc/nginx

Remediation

  • Edit the file /etc/nginx/nginx.conf. Example:
# WEB
sed -i "s/ssl_protocols[^;]*;/ssl_protocols TLSv1.2;/" /etc/nginx/nginx.conf
# proxy
sed -i "s/proxy_ssl_protocols[^;]*;/proxy_ssl_protocols TLSv1.2;/" /etc/nginx/nginx.conf
# If not configured, pay attention to the location:
# web
server {
 ssl_protocols TLSv1.2;
}

# proxy
location / {
 proxy_ssl_protocols TLSv1.2;
 }

Impact

  • Disabling certain TLS versions may prevent legacy user agents from connecting to your server. Disabling negotiation of specific protocols with backend servers may also limit your ability to connect to older servers. When choosing TLS protocols, you should always consider whether support for older user agents or servers is required.

Default Value

  • By default, NGINX does not specify TLS protocols and accepts all TLS versions.

References

CIS Controls

  • None

Feedback

Is this page helpful?