Since these two are using GCM (Galois/Counter Mode):

www.ssllabs.com: ECDHE-RSA-AES256-GCM-SHA384
www.google.com: ECDHE-RSA-AES128-GCM-SHA256

We wanted to make our webserver's HTTPS connection more secure (Don't look at the self-signed certificate, that doesn't count right now...).

We are using an OpenBSD 5.4 64bit OS, and the openssl ciphers command says that it supports the ECDHE-RSA-AES256-GCM-SHA384 cipher. On client side there is Firefox 30 at least.

So here is how we setup the HTTPS server:

# generate self signed certificate
    openssl genrsa -aes256 -out /etc/ssl/private/server.key 4096
    openssl req -new -key /etc/ssl/private/server.key -out /etc/ssl/private/server.csr
    openssl x509 -sha512 -req -days 365 -in /etc/ssl/private/server.csr -signkey /etc/ssl/private/server.key -out /etc/ssl/server.crt

The config:

vi /etc/nginx/nginx.conf
    ssl_protocols TLSv1.2;
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers   on;

But Firefox says (I translated it from my language..):

A connection to the www.foo.hu is interrupted

and ssllabs says:

Assessment failed: Failed to communicate with the secure server

  • How can we set GCM in nginx?
  • Why couldn't a fresh Firefox connect via HTTPS to www.foo.hu (ECDHE-RSA-AES256-GCM-SHA384, TLSv1.2)?

It can connect to www.ssllabs.com via HTTPS (ECDHE-RSA-AES256-GCM-SHA384, TLSv1.2), so maybe it's not a client side problem?

[user@localhost ~] openssl s_client -connect www.foo.hu:443
depth=0 C = HU, CN = www.foo.hu
verify error:num=18:self signed certificate
verify return:1
depth=0 C = HU, CN = www.foo.hu
verify return:1
Certificate chain
 0 s:/C=HU/CN=www.foo.hu
Server certificate
.... here goes the cert..
No client certificate CA names sent
SSL handshake has read 2137 bytes and written 389 bytes
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 4096 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: ...bla-bla
    Master-Key: ...bla-bla
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:

    Start Time: 1404296744
    Timeout   : 300 (sec)
    Verify return code: 18 (self signed certificate)
[user@localhost ~] 
  • nginx error logs? – deed02392 Jul 3 '14 at 8:24
  • Do you know it's GCM that causes the problem? Choice of curves for ECDHE or hash algorithm for the RSA signature are potential failure points. – CodesInChaos Jul 3 '14 at 8:46

Changing the cipher suite was the final solution.

ssl_protocols TLSv1.2;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256;

The problem was that Firefox 30 doesn't supports the mentioned cipher yet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.