含铬NET::ERR_SSL_OBSOLETE_VERSION
含铬NET::ERR_SSL_OBSOLETE_VERSION
提问于 2020-11-12 04:31:22
我有一个托管在AWS ec2中的节点应用程序，并安装了letsencrypt证书。当我试图访问API时，它出现了错误。
连接-过时的连接设置此站点的连接是加密和验证使用TLS1.0，ECDHE_RSA和AES_256_CBC与HMAC 1。TLS 1.0已过时。启用TLS 1.2或更高版本。AES_256_CBC已经过时了。启用基于AES-GCM的密码套件.
SSL证书从letsencrypt中正确显示。
事实上，我在配置文件中设置了基于TLS 1.2AES-GCM的密码.我的nginx版本
nginx版本: nginx/1.16.1 OpenSSL 1.0.2k-fips 2017年1月26日
有什么指示吗？
这是我的nginx.conf文件片段
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
access_log /var/log/nginx/access.log main;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
server {
listen 80;
listen 443 ssl;
server_name localhost;
root /usr/share/nginx/html;
ssl_certificate /opt/ssl/cacert.pem;
ssl_certificate_key /opt/ssl/privkey.pem;
ssl_session_timeout 5m;
ssl_protocols SSLv2 TLSv1.2 TLSv1.1 TLSv1;
#ssl_protocols SSLv2 SSLv3 TLSv1;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
#charset koi8-r;
}
server {
listen 443 ssl http2;
server_name aws.qureme.co.in;
root /usr/share/nginx/html;
ssl_certificate /etc/letsencrypt/live/aws.qureme.co.in/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/aws.qureme.co.in/privkey.pem;
ssl_session_timeout 5m;
ssl_protocols TLSv1.2 TLSv1.1 TLSv1 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
ssl_ecdh_curve secp384r1;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8;
}}
回答 1
Stack Overflow用户
回答已采纳
发布于 2020-11-12 10:27:06
问题是当我为两个服务器块设置不同的协议和密码时(一个用于IP地址，另一个用于域名。
非常感谢STEFFEN 的输入。这是修改后的规范
server {
listen 80;
listen 443 ssl;
server_name localhost;
root /usr/share/nginx/html;
ssl_certificate /opt/ssl/cacert.pem;
ssl_certificate_key /opt/ssl/privkey.pem;
ssl_session_timeout 5m;
ssl_protocols TLSv1.2 TLSv1.1 TLSv1 TLSv1.3;
ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
ssl_prefer_server_ciphers on;
}
server {
listen 443 ssl http2;
server_name aws.qureme.co.in;
root /usr/share/nginx/html;
ssl_certificate /etc/letsencrypt/live/aws.qureme.co.in/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/aws.qureme.co.in/privkey.pem;
ssl_session_timeout 5m;
ssl_protocols TLSv1.2 TLSv1.1 TLSv1 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
}页面原文内容由Stack Overflow提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接：
https://stackoverflow.com/questions/64797953
复制相关文章
相似问题
腾讯云开发者
