Dockerfile icon indicating copy to clipboard operation
Dockerfile copied to clipboard

SSL handshake not working after update to ECDSA

Open brafreider opened this issue 3 years ago • 0 comments

in webdevops/php-nginx-dev:8.1 SSL stops working after my letsencrypt certificate changed to ECDSA

To solve this, I overwrite the conf/etc/nginx/vhost.ssl.conf with an updated version of the file, extracted from the image:

ssl           on;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # not possible to do exclusive
#ssl_ciphers   'EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA';
ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384";
ssl_prefer_server_ciphers on;

ssl_certificate     /opt/docker/etc/nginx/ssl/server.crt;
ssl_certificate_key /opt/docker/etc/nginx/ssl/server.key;

I'm not a ssl_ciphers expert, but probably the ECDSA cipher could just be added to the base image configuration (the disabled ssl_ciphers) to support newer letsencrypt certificates out of the box.

brafreider avatar Jan 18 '23 15:01 brafreider