Issue TLS 1.2 and 1.3 only

[E42]

Server operating system version

Debian 11

Plesk version and microupdate number

Obsidian

Hello,
I followed the guide here https://support.plesk.com/hc/en-us/...able-TLS-protocol-versions-in-Plesk-for-Linux

But this command:
plesk bin server_pref -u -ssl-protocols 'TLSv1.2 TLSv1.3'
Does not seem enough.
A simple test with the tester on Qualys SSL Labs will give "B" rating and show TLS 1.0/1.1 ciphers. So my guess is that we should also explicitly set TLS 1.2/1.3 only ciphers. How can I found such an updated / tried-and-tested / approved list? Is the one in the article above correct for TLS 1.2/1.3?

 

[Kulturmensch]

I just found your question. If it is still open then it could help to look in Plesk-UI for websites/domains/your domain/ssl-certificates/serverconfiguration. Here you can choose an appropriate variant for TLS/ciphers provided by mozilla which comes together with relevant ciphers. If you do this be aware that the modern variant only provides TLSv1.3 but the variant intermediate provides both TLSv1.2 and 1.3 . Having done this you will proably get A or A+ with ssl-labs test depending on HSTS enabled or not..
This works in my case now seamless in Plesk-UI and I do not configure it any longer in the bash.

 

[Benemortasia]

If you arent looking for a specific kind of setup. But just want to be compliant with the current best
practices for SSL configuration, following one of the 3 levels of configuration current defined in:

Mozilla SSL Configuration Generator



Modern: Services with clients that support TLS 1.3 and don't need backward compatibility
Intermediate: General-purpose servers with a variety of clients, recommended for almost all systems
Old: Compatible with a number of very old clients, and should be used only as a last resort

The most simple way to apply one of those 3 templates in a few clicks is using SSL It!
- Make sure it is installed and open the SSL It! extension settings
(Tools&Settings->Security->TLS versions and ciphers management-> click settings)



- Here you can enable Mozilla ciphers and sync them to apply it.

(In your case. AND if you are aiming for an A or A+ rating. Select intermediate)





I suggest you reboot the server after configuring.