From 4a878fac9f41daf010ffbb9bed17c55f33acb58b Mon Sep 17 00:00:00 2001 From: samsepi0l Date: Thu, 21 Dec 2023 09:13:15 +0100 Subject: [PATCH] [bitnami/nginx] Specify ciphers suites and set strong ciphers (#53352) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Specify ciphers suites for better control and security It's better to specify cipher suites to avoid having too many ciphers authorized. It allow better control of which cipher suites you use. The cipher have been choosed based on https://english.ncsc.nl/publications/publications/2021/january/19/it-security-guidelines-for-transport-layer-security-2.1 Signed-off-by: samsepi0l * Remove useless ciphers Signed-off-by: samsepi0l * Add "ssl_prefer_server_ciphers" and prioritize ChaCha20 suites with clients that don't have AES-NI Signed-off-by: samsepi0l * Update bitnami/nginx/1.25/debian-11/rootfs/opt/bitnami/nginx/conf/nginx.conf Co-authored-by: Juan José Martos Signed-off-by: samsepi0l --------- Signed-off-by: samsepi0l Signed-off-by: samsepi0l Co-authored-by: samsepi0l Co-authored-by: Juan José Martos --- .../1.25/debian-11/rootfs/opt/bitnami/nginx/conf/nginx.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bitnami/nginx/1.25/debian-11/rootfs/opt/bitnami/nginx/conf/nginx.conf b/bitnami/nginx/1.25/debian-11/rootfs/opt/bitnami/nginx/conf/nginx.conf index aaf0428032c4..9833b1cfd043 100644 --- a/bitnami/nginx/1.25/debian-11/rootfs/opt/bitnami/nginx/conf/nginx.conf +++ b/bitnami/nginx/1.25/debian-11/rootfs/opt/bitnami/nginx/conf/nginx.conf @@ -34,7 +34,7 @@ http { gzip_types text/plain text/css application/javascript text/xml application/xml+rss; keepalive_timeout 65; ssl_protocols TLSv1.2 TLSv1.3; - ssl_ciphers HIGH:!aNULL:!MD5; + ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305; client_max_body_size 80M; server_tokens off;