How to activate TLSv1.3 on NGINX. VestaCP pe CentOS with OpenSSL

In this tutorial we will see how activate TLSv1.3 on NGINX, let's understand a little what does it mean this TLS 1.3, what helps and why we need on the webserver as TLS to be activated. Let's understand why on a server with VestaCP (CentOS or Ubuntu) is a little more difficult to activate TLS 1.3 than on a cPanel server. Or on a server where we have no hosting management software.

Why is it better TLS 1.3 than TLS 1.2?

TLS (Transport Layer Security) is a cryptographic protocol which ensures connection security between the computer and a network it belongs to. TLS is used in applications such as: Email, messaging, voice and video calls (VoIP), but especially at HTTPS. Ensuring a secure communication between the user's computer or smartphone and the web server of the accessed page.

TLSv1.3 offers higher speed client - server connection and a Moreover security by eliminating some algorithms. The differences between TLSv1.2 and TLSv1.3.

About HTTPS, SSL (Secure Sockets Layer) I also said in other articles:

How to activate TLSv1.3 on NGINX. Server with VestaCP installed on CentOS

Before we see how we activate TLSv1.3 on NGINX, we must have a minimum of software requirements and libraries present.

  1. NGINX 1.13.x or later
  2. A certificate TLS valid
  3. Active domain name with correctly configured DNS - to be accessible on the internet
  4. A certificate TLS / SSL valid. It could also be Let's Encrypt.

On a VestaCP installed a long time ago, we only have the protocol TLS 1.2. I have seen in many tutorials that it is enough as in nginx.conf let's add the following line because TLS 1.3 to be activated:

server {

  listen 443 ssl http2;
  listen [::]:443 ssl http2;

  server_name example.com;
  root /var/www/example.com/public;

  ssl_certificate /path/to/your/certificate.crt;
  ssl_certificate_key /path/to/your/private.key;

  ssl_protocols TLSv1.2 TLSv1.3;

Fake. If On a server CentOS cu VestaCP, NGINX has not been compiled with the minimum version of OpenSSL 1.1.1.1, ssl_protocols TLSv1.2 TLSv1.3; in nginx.conf it doesn't help us at all.

[root@north ~]# nginx -V
nginx version: nginx/1.22.0
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-44) (GCC) 
built with OpenSSL 1.0.2k-fips  26 Jan 2017
TLS SNI support enabled

Therefore, in the example above Nginx 1.22.0 is compatible with TLSv1.3, but the Open library does not help usSSL 1.0.2k-fips.

To activate TLSv1.3 on Nginx, we must first install the children's libraries and development packages. Development Tools. We run on CentOS 7 command lines:

yum install gcc gcc-c++ pcre-devel zlib-devel make unzip gd-devel perl-ExtUtils-Embed libxslt-devel openssl-devel perl-Test-Simple
yum groupinstall 'Development Tools'

1. Install the latest Open versionSSL

At this time the latest version is OpenSSL 1.1.1p, but from what I noticed there is already OpenSSL 3. You can find the sources on OpenSSL. Org.

cd /usr/src
wget https://www.openssl.org/source/openssl-1.1.1p.tar.gz
tar xvf openssl-1.1.1p.tar.gz 
mv openssl-1.1.1p openssl
cd openssl
./config --prefix=/usr/local/openssl --openssldir=/usr/local/openssl --libdir=/lib64 shared zlib-dynamic
make -j4
make test 
make install 

Very important to run make test before installing the library. If errors occurred during the test, do not run make install until the errors are corrected.

In the next step, we back up the current open binary filessl and we add symlink to the new one.

mv /usr/bin/openssl /usr/bin/openssl-backup
ln -s /usr/local/openssl/bin/openssl /usr/bin/openssl

In /usr/local/openssl/bin perform ldd to check for open dependenciesssl. We can also check the open versionssl. Command openssl version.

[root@north bin]# ldd openssl
	linux-vdso.so.1 =>  (0x00007ffd20bd7000)
	libssl.so.1.1 => /lib64/libssl.so.1.1 (0x00007fab09b62000)
	libcrypto.so.1.1 => /lib64/libcrypto.so.1.1 (0x00007fab09675000)
	libdl.so.2 => /lib64/libdl.so.2 (0x00007fab09471000)
	libpthread.so.0 => /lib64/libpthread.so.0 (0x00007fab09255000)
	libc.so.6 => /lib64/libc.so.6 (0x00007fab08e87000)
	/lib64/ld-linux-x86-64.so.2 (0x00007fab09df5000)
[root@north bin]# openssl version
OpenSSL 1.1.1p  21 Jun 2022

We currently have the latest version of Open installedSSL supporting TLSv1.3. We can check the versions TLS / SSL supported by Open librariesSSL by order:

[root@north bin]# openssl ciphers -v | awk '{print $2}' | sort | uniq
SSLv3
TLSv1
TLSv1.2
TLSv1.3
[root@north bin]# 

This does not mean that websites are hosted on VestaCP they will have immediately TLS 1.3. neither macar Nginx is not yet compiled for the new version of OpenSSL.

Although we have Open installedSSL 1.1.1p, Nginx is compiled with the old Open versionSSL 1.0.2k-fips.

[root@north bin]# nginx -V
nginx version: nginx/1.22.0
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-44) (GCC) 
built with OpenSSL 1.0.2k-fips  26 Jan 2017
TLS SNI support enabled
configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-compat --with-file-aio --with-threads --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-mail --with-mail_ssl_module --with-stream --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -fPIC' --with-ld-opt='-Wl,-z,relro -Wl,-z,now -pie'
[root@north bin]# openssl version
OpenSSL 1.1.1p  21 Jun 2022
[root@north bin]# 

2. Recompile Nginx on VestaCP

In this step we have to recompile for OpenSSL the version of Nginx already installed pe CentOS / VestaCP. As I said above, in my case it is about nginx / 1.22.0. Being about a webserver that has VestaCP as a system of adminBefore starting the recompilation, it is good to back up the nginx configuration files.

Current Nginx backup on VestaCP

Archive and store directories somewhere on the server "/etc/nginx"And"/usr/local/vesta/nginx".

executed nginx -V and save the existing modules to a file.

configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-compat --with-file-aio --with-threads --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-mail --with-mail_ssl_module --with-stream --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -fPIC' --with-ld-opt='-Wl,-z,relro -Wl,-z,now -pie'
How to activate TLSv1.3 on NGINX
How to activate TLSv1.3 on NGINX

We download and compile Nginx

Repeat. If you have VestaCP, download the version of Nginx that you already have installed. All archives with Nginx versions can be found on nginx.org.

cd /usr/src
wget https://nginx.org/download/nginx-1.22.0.tar.gz 
tar xvf nginx-1.22.0.tar.gz
cd nginx-1.22.0

We recompile the nginx modules:

./configure --prefix=/etc/nginx \
--sbin-path=/usr/sbin/nginx \ 
--modules-path=/usr/lib64/nginx/modules \ 
--conf-path=/etc/nginx/nginx.conf \ 
--error-log-path=/var/log/nginx/error.log  \
--http-log-path=/var/log/nginx/access.log  \
--pid-path=/var/run/nginx.pid  \
--lock-path=/var/run/nginx.lock  \
--http-client-body-temp-path=/var/cache/nginx/client_temp  \
--http-proxy-temp-path=/var/cache/nginx/proxy_temp  \
--http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp  \
--http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp  \
--http-scgi-temp-path=/var/cache/nginx/scgi_temp  \
--user=nginx  \
--group=nginx  \
--with-compat  \
--with-file-aio  \
--with-threads  \
--with-http_addition_module  \
--with-http_auth_request_module  \
--with-http_dav_module  \
--with-http_flv_module  \
--with-http_gunzip_module  \
--with-http_gzip_static_module  \
--with-http_mp4_module  \
--with-http_random_index_module  \
--with-http_realip_module  \
--with-http_secure_link_module  \
--with-http_slice_module  \
--with-http_ssl_module  \
--with-http_stub_status_module  \
--with-http_sub_module  \
--with-http_v2_module  \
--with-mail  \
--with-mail_ssl_module  \
--with-stream  \
--with-stream_realip_module  \
--with-stream_ssl_module  \
--with-stream_ssl_preread_module  \
--with-openssl=/usr/src/openssl  \
--with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong  \
--param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -fPIC'  \
--with-ld-opt='-Wl,-z,relro -Wl,-z,now -pie'
make -j4
make install

We now have Nginx installed and compiled with the latest version of OpenSSL able to withstand TLSv1.3.

[root@north bin]# nginx -V
nginx version: nginx/1.22.0
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-44) (GCC) 
built with OpenSSL 1.1.1p  21 Jun 2022
TLS SNI support enabled

How to activate TLSv1.3 for domains on VestaCP

In the / etc / nginx / filenginx.conf we add the following lines:

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';

At the domain level, I changed something in the templates VestaCP and to enable HTTP / 2. So when adding a new domain (example.com) with Let's Encrypt enabled, I have the following configuration file for SSL:

cat /home/vestacpuser/conf/web/example.com.nginx.ssl.conf 

server {
    listen      IP.IP.IP.IP:443 ssl http2;
    server_name example.com www.example.com;
    root        /home/vestacpuser/web/example.com/public_html;
    index       index.php index.html index.htm;
    access_log  /var/log/nginx/domains/example.com.log combined;
    access_log  /var/log/nginx/domains/example.com.bytes bytes;
    error_log   /var/log/nginx/domains/example.com.error.log error;

    ssl_certificate      /home/vestacpuser/conf/web/ssl.example.com.pem;
    ssl_certificate_key  /home/vestacpuser/conf/web/ssl.example.com.key;

....

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';

Before you restartyou have nginx, it is good that before testing its configuration.

[root@north web]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
[root@north web]# systemctl restart nginx

I hope you find this tutorial useful, and if you do not succeed in something, leave the details of the problem in the comments.

Stealth

Passionate about technology, I like to test and write tutorials about operating systems macOS, Linux, Windows, about WordPress, WooCommerce and configure LEMP web servers (Linux, NGINX, MySQL and PHP). I write on StealthSettings.com since 2006, and a few years later I started writing on iHowTo.Tips tutorials and news about devices in the ecosystem Apple: iPhone, iPad, Apple Watch, HomePod, iMac, MacBook, AirPods and accessories.

Leave a Reply

Your email address will not be published.

Related Articles

/ / /
tags: / / / / / /
Back to top button