Just updated Debian from "stable" 9.* to "testing" 10.*.
Have nginx 1.14 - used to come from "stable backports" now included in Debian itself.
Seeing a strange issue with TLS versions in nginx.
TLS 1.3 is enabled, and 1.2 is too, but I can't seem to get TLS 1.0 / 1.1 even though they're included in nginx configs.
Oh and by the way, Dovecot running on same system still has TLS 1.0 - 1.1 - 1.2 - 1.3 all functional:
relevant bits from nginx site config:
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
I tried removing either
ssl_ciphers or both, nothing changed really.
Is this an intentional change in nginx - upstream or as packaged by Debian? A change in openssl itself?
Any way I can enable all TLS versions from 1.0 and up to 1.3 in nginx at the same time?
Oh a note about Dovecot... I'm running the version from their repo, not from Debian's, and it's for Debian "stable" not "testing" and so probably was linked against OpenSSL 1.1 without TLS 1.3 support.
It has a different way (from nginx's) to specify TLS versions:
ssl_min_protocol = TLSv1
which before updating Debian resolved to 1.0 / 1.1 / 1.2 and now resolves to 1.0 - 1.3 inclusive.
Wonder if there is a way to specify nginx protocols the same way (and which would get me all of TLS 1.0 - 1.3).