Perfect Forward Secrecy Fix

calendar2020-06-07 · 1 min read · sslcert tlscert perfect-forward-secrecy pfs  ·
Share on: linkedincopy
  1. Generate dhparam.pem
1openssl dhparam -out /etc/nginx/ssl/dhparam.pem 4096
  1. Create /etc/nginx/conf.d/perfect-forward-secrecy.conf since all *.conf in /etc/nginx/conf.d:
1ssl_protocols TLSv1.2;
2ssl_prefer_server_ciphers on;
3ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !MEDIUM";
4
5ssl_dhparam /etc/nginx/ssl/dhparam.pem;

  1. Reload nginx

  2. Test again using the SSLLabs Tool

https://www.howtoforge.com/ssl-perfect-forward-secrecy-in-nginx-webserver