Just updated Debian from "stable" 9.* to "testing" 10.*.

Have nginx 1.14 - used to come from "stable backports" now included in Debian itself.

Seeing a strange issue with TLS versions in nginx.

TLS 1.3 is enabled, and 1.2 is too, but I can't seem to get TLS 1.0 / 1.1 even though they're included in nginx configs.


Oh and by the way, Dovecot running on same system still has TLS 1.0 - 1.1 - 1.2 - 1.3 all functional:


relevant bits from nginx site config:

ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; ssl_ciphers kECDHE+CHACHA20:kECDHE+AESGCM:kDHE+AESGCM:kECDHE+AES+SHA:kDHE+AES+SHA:!AESCCM:!aNULL:!eNULL; ssl_prefer_server_ciphers on;

I tried removing either ssl_protocols or ssl_ciphers or both, nothing changed really.

Is this an intentional change in nginx - upstream or as packaged by Debian? A change in openssl itself?

Any way I can enable all TLS versions from 1.0 and up to 1.3 in nginx at the same time?

Oh a note about Dovecot... I'm running the version from their repo, not from Debian's, and it's for Debian "stable" not "testing" and so probably was linked against OpenSSL 1.1 without TLS 1.3 support.

It has a different way (from nginx's) to specify TLS versions:

ssl_min_protocol = TLSv1

which before updating Debian resolved to 1.0 / 1.1 / 1.2 and now resolves to 1.0 - 1.3 inclusive.

Wonder if there is a way to specify nginx protocols the same way (and which would get me all of TLS 1.0 - 1.3).

  • Found this debian news item --- Instead of completly disabling TLS 1.0 and 1.1, just set the minimum version to TLS 1.2 by default. TLS 1.0 and 1.1 can be enabled again by calling SSL_CTX_set_min_proto_version() or SSL_set_min_proto_version(). --- So Dovecot already uses set_min_proto_version I guess, while nginx use the "older" method, and does not have code to explicitly enable 1.0 and 1.1. Sound about right? Still the question remains - anything I can do to re-enable TLS 1.0 and 1.1 in nginx? – Kostya Vasilyev Nov 15 '18 at 15:48

Got an answer on nginx forums:


Short version:

  • Edit /etc/ssl/openssl.conf

  • Make this change

[system_default_sect] -MinProtocol = TLSv1.2 +MinProtocol = TLSv1 CipherString = DEFAULT@SECLEVEL=2

This changes the system default minimum enabled protocol from TLS 1.2 to 1.0.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.