Re: nginx, and cloudflare (and maybe trixie?)

[Dan Ritter <dsr@randomstring.org>]

Antonio Russo wrote: 
> In case anyone else is using nginx and cloudflare:
> 
> The documentation for ssl options on your origin server that cloudflare
> provides [1] indicate that you should use
> 
>  ssl_prefer_server_ciphers on;
> 
> I found that setting this option caused a
> 
>  SSL_do_handshake() failed (SSL: error:????????:SSL routines::bad cipher) while SSL handshaking
> 
> error, at least after upgrading to trixie.  This manifests as a generic 525 error on the browser.
> 
> It's not clear to me what the implications of setting this to "off" are (the default for
> trixie).
> 
> 
> [1] https://developers.cloudflare.com/ssl/origin-configuration/cipher-suites/


It seems likely to me that you should take the error at face
value and check to see whether you are trying for an SSL cipher
that Cloudflare does not support.

The same page states that you should use:

ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-CHACHA20-POLY1305:ECDHE+AES128:RSA+AES128:ECDHE+AES256:RSA+AES256:ECDHE+3DES:RSA+3DES;

Is that what you have?

If it is, and nginx has been restarted, you should report the
issue to Cloudflare.

-dsr-