From 60f8fc575ac5f983379fcca2198a6e90f15635a9 Mon Sep 17 00:00:00 2001 From: Gyorgy Berenyi Date: Mon, 1 Nov 2021 20:08:30 +0000 Subject: [PATCH] Diffie-Hellman (DHE) key exchange should be disabled. --- scripts/nginx_config_create.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/nginx_config_create.sh b/scripts/nginx_config_create.sh index 452d3d8..e33addb 100755 --- a/scripts/nginx_config_create.sh +++ b/scripts/nginx_config_create.sh @@ -88,7 +88,7 @@ proxy_ssl_server_name on; ssl_certificate_key /etc/ssl/keys/$DOMAIN/key.pem; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; - ssl_ciphers "'"EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4"'"; + ssl_ciphers "'"EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4 !kDHE"'"; ssl_session_cache shared:SSL:50m; ssl_session_timeout 5m; ssl_stapling on;"