Resolved SSL certificate problem only in IE

[Heppi75]

hi,

I have problem with the SSL cert only in internet explorer.

I am running centOS 7 with plesk 12.5.30 (latest build). could anyone help why only the internet explorer is not working correct with the cert?

here is the url - I tried it in internet explorer 11 - with the message that I should check the TLS settings:

https://www.bioaustria.at/

maybe someone could help me please!

 

[Lloyd_mcse]

Hi,
I just visited your site in Edge and IE with no error, are you still having the issue? If so try to clear your browser cache.
Kind regards

Lloyd

 

[Sergio Manzi]

No, I can't access it (Win8.1/IE11)

... and there is a curious error page (see attached screen capture).

... but the error in the error page seems to be a local IE11 thing...

 

[urki]

@Sergio Manzi, @Heppi75,

The site opens normally for me as well (Windows 10, IE 11).

But it seems you have 'enabled' HTTP/2 on your server, which by default generates 'strict' cipher suites, making a lot of devices unable to connect, check SSL labs for some useful info about your configuration > https://www.ssllabs.com/ssltest/analyze.html?d=www.bioaustria.at

You might also want to read more on the issue on this thread > https://talk.plesk.com/threads/nginx-http-2-support-cipher-problems.337707/

To sum up, a solution would be to change your cipher list, you can use this in your /etc/nginx/conf.d/ssl.conf to enable support for 'most' devices

ssl_ciphers EECDH+AESGCM+AES128:EECDH+AESGCM+AES256:EECDH+CHACHA20:EDH+AESGCM+AEAES128:EDH+SHA1+AES256:EECDH+HIGH:EDH+HIGH:AESGCM+AES128:AESGCM+AES256:CHACHA20:
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

 

[Sergio Manzi]

If you look at the ssllabs report you'll see that there are key exchange problems for IE under anything lower than Win10, Safari < 9, Android < 4.4 and some more.

Yes that's probably due to HTTP/2 being enabled.

For a good list of HTTP/2 compatible software (and each has a link to further information) see: https://github.com/http2/http2-spec/wiki/Implementations

 

[Sergio Manzi]

Try disabling HTTP/2 (plesk bin http2_pref disable) and see how it goes...

 

[Heppi75]

hi,

this solved my problem - it would also be an option to disable HTTP2 ...

https://talk.plesk.com/threads/nginx-http-2-support-cipher-problems.337707/

 

[Sergio Manzi]

Hi, @Heppi75!

Glad you solved your issue, but.... which of the many suggestions of https://talk.plesk.com/threads/nginx-http-2-support-cipher-problems.337707/ have you adopted?

Personally I find wisdom in @trialotto answer, i.e. "not lower TLS versions in the case that HTTP/2 support is enabled".

I'm not an expert in the matter, but it seems to be logical that if you enable HTTP/2 you want it to behave like it is expected and not use TLS < 1.2 (or just use good old HTTP/1.1).

I'm anyway very open to be corrected on this point of view...

 

[Heppi75]

hi, sergio

I only adapted the ssl_ciphers settings this way:
EECDH+AESGCM+AES128:EECDH+AESGCM+AES256:EECDH+CHACHA20:EDH+AESGCM+AES128:EDH+AESGCM+AES256:EDH+CHACHA20:EECDH+SHA256+AES128:EECDH+SHA384+AES256:EDH+SHA256+AES128:EDH+SHA256+AES256:EECDH+SHA1+AES128:EECDH+SHA1+AES256:EDH+SHA1+AES128:EDH+SHA1+AES256:EECDH+HIGH:EDH+HIGH:AESGCM+AES128:AESGCM+AES256:CHACHA20:SHA256+AES128:SHA256+AES256:SHA1+AES128:SHA1+AES256:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!KRB5:!aECDH:!EDH+3DES;

 

[Sergio Manzi]

Now I can reach it, but I see HTTP/1.1 is used (see attached request and response snapshots...)

 

[Sergio Manzi]

... but on the other hand, when accessing from Firefox I see HTTP/2 is used, so apparently you have found and used the magic combination of ciphers that allows you to use HTTP/2 if supported by the browser or HTTP/1.1 if not...

It would be nice if someone with more experience than I have in this kind of things would confirm that this is OK...

P.S.: and https://www.ssllabs.com/ssltest/analyze.html?d=www.bioaustria.at says that you can exchange keys and be seen by everybody except IE6/XP, IE8/XP, Java 6 and Android 2.3.7

 

[jgeisler]

@Sergio Manzi, @Heppi75,

The site opens normally for me as well (Windows 10, IE 11).

But it seems you have 'enabled' HTTP/2 on your server, which by default generates 'strict' cipher suites, making a lot of devices unable to connect, check SSL labs for some useful info about your configuration > SSL Server Test: www.bioaustria.at (Powered by Qualys SSL Labs)

You might also want to read more on the issue on this thread > Resolved - nginx HTTP/2 support cipher problems

To sum up, a solution would be to change your cipher list, you can use this in your /etc/nginx/conf.d/ssl.conf to enable support for 'most' devices

ssl_ciphers EECDH+AESGCM+AES128:EECDH+AESGCM+AES256:EECDH+CHACHA20:EDH+AESGCM+AEAES128:EDH+SHA1+AES256:EECDH+HIGH:EDH+HIGH:AESGCM+AES128:AESGCM+AES256:CHACHA20:
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

You saved my day in the end of 2020