[GH-ISSUE #2823] TLS bug (TLS 1.0 & 1.1 offered - TLS 1.3 not offered) NMAP #1936

Closed
opened 2026-02-26 07:33:20 +03:00 by kerem · 16 comments
Owner

Originally created by @the-hotmann on GitHub (Apr 13, 2023).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/2823

This relates to:

Running onn latest 2.10.2

When I run: nmap --script ssl-enum-ciphers -p 443 example.domain.tld

I get this as response:

Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-13 09:52 CEST
Nmap scan report for example.domain.tld (123.123.123.123)
Host is up (0.0087s latency).

PORT    STATE SERVICE
443/tcp open  https
| ssl-enum-ciphers:
|   TLSv1.0:
|     ciphers:
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (ecdh_x25519) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (rsa 2048) - A
|     compressors:
|       NULL
|     cipher preference: server
|   TLSv1.1:
|     ciphers:
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (ecdh_x25519) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (rsa 2048) - A
|     compressors:
|       NULL
|     cipher preference: server
|   TLSv1.2:
|     ciphers:
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A
|       TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A
|       TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 (ecdh_x25519) - A
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A
|       TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 (ecdh_x25519) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ecdh_x25519) - A
|       TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 (ecdh_x25519) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (ecdh_x25519) - A
|       TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 (ecdh_x25519) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (ecdh_x25519) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A
|       TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CCM_8 (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CCM (rsa 2048) - A
|       TLS_RSA_WITH_ARIA_256_GCM_SHA384 (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_CCM_8 (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_CCM (rsa 2048) - A
|       TLS_RSA_WITH_ARIA_128_GCM_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (rsa 2048) - A
|     compressors:
|       NULL
|     cipher preference: server
|_  least strength: A

Nmap done: 1 IP address (1 host up) scanned in 1.98 seconds

Problems:

  1. TLS 1.0 & TLS 1.1 are both getting offered, even though they should be disabled. (#125)
  2. `TLS 1.3``is not getting offered at all, even though it is configured (#2822)

I have seen and checked the config /etcnginx/conf.d/include/ssl-ciphers.conf but could not find the bug.

Wanted:

  • nmap should not report that the server is capable of TLS 1.0 & TLS 1.1 at all
  • nmap should report that the server is capable of TLS 1.3

Thanks in advance! :)

P.S.: I am open for a discussion

Originally created by @the-hotmann on GitHub (Apr 13, 2023). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/2823 This relates to: - #2822 - #125 Running onn latest 2.10.2 When I run: `nmap --script ssl-enum-ciphers -p 443 example.domain.tld` I get this as response: ``` Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-13 09:52 CEST Nmap scan report for example.domain.tld (123.123.123.123) Host is up (0.0087s latency). PORT STATE SERVICE 443/tcp open https | ssl-enum-ciphers: | TLSv1.0: | ciphers: | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (ecdh_x25519) - A | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A | TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A | TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (rsa 2048) - A | TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A | TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (rsa 2048) - A | compressors: | NULL | cipher preference: server | TLSv1.1: | ciphers: | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (ecdh_x25519) - A | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A | TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A | TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (rsa 2048) - A | TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A | TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (rsa 2048) - A | compressors: | NULL | cipher preference: server | TLSv1.2: | ciphers: | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A | TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A | TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 (ecdh_x25519) - A | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A | TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 (ecdh_x25519) - A | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ecdh_x25519) - A | TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 (ecdh_x25519) - A | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (ecdh_x25519) - A | TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 (ecdh_x25519) - A | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (ecdh_x25519) - A | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A | TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A | TLS_RSA_WITH_AES_256_CCM_8 (rsa 2048) - A | TLS_RSA_WITH_AES_256_CCM (rsa 2048) - A | TLS_RSA_WITH_ARIA_256_GCM_SHA384 (rsa 2048) - A | TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A | TLS_RSA_WITH_AES_128_CCM_8 (rsa 2048) - A | TLS_RSA_WITH_AES_128_CCM (rsa 2048) - A | TLS_RSA_WITH_ARIA_128_GCM_SHA256 (rsa 2048) - A | TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A | TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 (rsa 2048) - A | TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A | TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 (rsa 2048) - A | TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A | TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (rsa 2048) - A | TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A | TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (rsa 2048) - A | compressors: | NULL | cipher preference: server |_ least strength: A Nmap done: 1 IP address (1 host up) scanned in 1.98 seconds ``` Problems: 1. `TLS 1.0` & `TLS 1.1` are both getting offered, even though they should be disabled. (#125) 2. `TLS 1.3``is not getting offered at all, even though it is configured (#2822) I have seen and checked the config `/etcnginx/conf.d/include/ssl-ciphers.conf` but could not find the bug. Wanted: - `nmap` should not report that the server is capable of `TLS 1.0` & `TLS 1.1` at all - `nmap` should report that the server is capable of `TLS 1.3` Thanks in advance! :) P.S.: I am open for a discussion
kerem 2026-02-26 07:33:20 +03:00
  • closed this issue
  • added the
    stale
    bug
    labels
Author
Owner

@jebabin commented on GitHub (Apr 14, 2023):

As a workaround, try to add ssl_protocols TLSv1.2 TLSv1.3; in /data/nginx/custom/http.conf it should at least fix the non working TLS 1.3 part

<!-- gh-comment-id:1508103916 --> @jebabin commented on GitHub (Apr 14, 2023): As a workaround, try to add `ssl_protocols TLSv1.2 TLSv1.3;` in /data/nginx/custom/http.conf it should at least fix the non working TLS 1.3 part
Author
Owner

@the-hotmann commented on GitHub (Apr 22, 2023):

Thanks! I will report back, once I implemented it.

However, that is actually the less important of the two issues.
It is more important not to offer TLSv1.0 and TLSv1.1, as these versions are insecure and pose a security risk.

<!-- gh-comment-id:1518722820 --> @the-hotmann commented on GitHub (Apr 22, 2023): Thanks! I will report back, once I implemented it. However, that is actually the less important of the two issues. It is more important not to offer `TLSv1.0` and `TLSv1.1`, as these versions are insecure and pose a security risk.
Author
Owner

@wokkeltje13 commented on GitHub (Apr 22, 2023):

I have no /data/nginx/custom/http.conf file

<!-- gh-comment-id:1518723824 --> @wokkeltje13 commented on GitHub (Apr 22, 2023): I have no /data/nginx/custom/http.conf file
Author
Owner

@kingfisher77 commented on GitHub (Apr 25, 2023):

I have no /data/nginx/custom/http.conf file

Have a look here.

nginx-proxy-manager is really a "Diva". Each update is a real risk...

<!-- gh-comment-id:1521810039 --> @kingfisher77 commented on GitHub (Apr 25, 2023): > I have no /data/nginx/custom/http.conf file Have a look [here](https://nginxproxymanager.com/advanced-config/#custom-nginx-configurations). nginx-proxy-manager is really a "Diva". Each update is a real risk...
Author
Owner

@wokkeltje13 commented on GitHub (Apr 25, 2023):

tnx, got the diva providing TLS 1.3

<!-- gh-comment-id:1521825393 --> @wokkeltje13 commented on GitHub (Apr 25, 2023): tnx, got the diva providing TLS 1.3
Author
Owner

@wokkeltje13 commented on GitHub (Apr 25, 2023):

For me there is no old TLS active, only 1.2 and 1.3
image

<!-- gh-comment-id:1521827800 --> @wokkeltje13 commented on GitHub (Apr 25, 2023): For me there is no old TLS active, only 1.2 and 1.3 ![image](https://user-images.githubusercontent.com/57153640/234298178-5bb3427c-bc83-493c-9ed5-e057e7147a0b.png)
Author
Owner

@kingfisher77 commented on GitHub (Apr 25, 2023):

I had to add ssl_protocols TLSv1.2 TLSv1.3; /data/nginx/custom/http.conf

<!-- gh-comment-id:1521830965 --> @kingfisher77 commented on GitHub (Apr 25, 2023): I had to add `ssl_protocols TLSv1.2 TLSv1.3;` /data/nginx/custom/http.conf
Author
Owner

@wokkeltje13 commented on GitHub (Apr 25, 2023):

This is what I did, but before only 1.2 was available, no 1.0 and 1.1

<!-- gh-comment-id:1521846747 --> @wokkeltje13 commented on GitHub (Apr 25, 2023): This is what I did, but before only 1.2 was available, no 1.0 and 1.1
Author
Owner

@nietzscheanic commented on GitHub (May 19, 2023):

pull request https://github.com/NginxProxyManager/nginx-proxy-manager/pull/2932

<!-- gh-comment-id:1554485853 --> @nietzscheanic commented on GitHub (May 19, 2023): pull request https://github.com/NginxProxyManager/nginx-proxy-manager/pull/2932
Author
Owner

@stanthewizzard commented on GitHub (May 31, 2023):

Hello
I'm using http.conf
What would be the best cypher ?

ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;

Thanks

<!-- gh-comment-id:1569713579 --> @stanthewizzard commented on GitHub (May 31, 2023): Hello I'm using http.conf What would be the best cypher ? ``` ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; ssl_prefer_server_ciphers off; ``` Thanks
Author
Owner

@dobbleg1000 commented on GitHub (Jun 3, 2023):

@stanthewizzard I would start a new issue for this question also dont include ssl_prefer_server_ciphers
as that is set elsewhere and will cause it to fail to start.

<!-- gh-comment-id:1574695140 --> @dobbleg1000 commented on GitHub (Jun 3, 2023): @stanthewizzard I would start a new issue for this question also dont include ssl_prefer_server_ciphers as that is set elsewhere and will cause it to fail to start.
Author
Owner

@github-actions[bot] commented on GitHub (Jan 22, 2024):

Issue is now considered stale. If you want to keep it open, please comment 👍

<!-- gh-comment-id:1902878225 --> @github-actions[bot] commented on GitHub (Jan 22, 2024): Issue is now considered stale. If you want to keep it open, please comment :+1:
Author
Owner

@Goldmaster commented on GitHub (Jul 28, 2024):

I have noticed that I get This server supports TLS 1.0 and TLS 1.1. Grade capped to B on ssl labs. Wonder if a pull request is needed to fix the issue?

<!-- gh-comment-id:2254549904 --> @Goldmaster commented on GitHub (Jul 28, 2024): I have noticed that I get This server supports TLS 1.0 and TLS 1.1. Grade capped to B on ssl labs. Wonder if a pull request is needed to fix the issue?
Author
Owner

@TimeJunkie01 commented on GitHub (Aug 13, 2024):

Turning off TLSv1 and TLSv1.1 is still an open issue. I am using v2.11.3.

<!-- gh-comment-id:2286436412 --> @TimeJunkie01 commented on GitHub (Aug 13, 2024): Turning off TLSv1 and TLSv1.1 is still an open issue. I am using v2.11.3.
Author
Owner

@the-hotmann commented on GitHub (Sep 20, 2024):

@Goldmaster @TimeJunkie01

I had to adjust the config manually to fix the problem.
But this was not good enough for me in the long run, so I decided that I dont care and will just use a plain nginx:1-alpine-slim docker image and configure stuff myself.

Can recommend this to everyone, as it make you understand the whole thing better and not rely on stuff, that you cant controll/manage.

For me this was a big problem due to security scans and alerts.

There are also other solutions out there, that do offer the same functionality (reverse proxying) with way more features, up-to-date config, secure defaults and additionally more dev-support. Just do some research, I dont want to talk this app down in its own issue-section.

<!-- gh-comment-id:2363643988 --> @the-hotmann commented on GitHub (Sep 20, 2024): @Goldmaster @TimeJunkie01 I had to adjust the config manually to fix the problem. But this was not good enough for me in the long run, so I decided that I dont care and will just use a plain `nginx:1-alpine-slim` docker image and configure stuff myself. Can recommend this to everyone, as it make you understand the whole thing better and not rely on stuff, that you cant controll/manage. For me this was a big problem due to security scans and alerts. There are also other solutions out there, that do offer the same functionality (reverse proxying) with way more features, up-to-date config, secure defaults and additionally more dev-support. Just do some research, I dont want to talk this app down in its own issue-section.
Author
Owner

@WarmWelcome commented on GitHub (Jan 27, 2025):

Are there any updates on this to disable 1.0-1.1 and only allow 1.2-1.3?

<!-- gh-comment-id:2614986991 --> @WarmWelcome commented on GitHub (Jan 27, 2025): Are there any updates on this to disable 1.0-1.1 and only allow 1.2-1.3?
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/nginx-proxy-manager-NginxProxyManager#1936
No description provided.