Question TLS1.3 SSL Configuration (ciphers in ssl.conf)

[Dukemaster]

Hi,
since a few hours my server provider Ionos updated Ubuntu 18.04.2 LTS with OpenSSL 1.1.1.
OpenSSL 1.1.1 is now running on server
For webhosting I use only Nginx.
Interesting: Plesk panel is already secured with TLS1.3 to my Firefox.

Do you know the proper configuration of ssl.conf to use TLS1.3.?
How to use TLS1.3?

My current configuration of ssl.conf is below

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS;
ssl_prefer_server_ciphers on;
ssl_session_timeout 10m;
ssl_session_cache shared:SSL:50m;
ssl_session_cache shared:ssl_session_cache:10m;
ssl_ecdh_curve X25519:secp521r1:secp384r1:prime256v1;
ssl_dhparam /etc/dhparam/dhparam4096.pem;

Help would be nice
Thanks

 

[IgorG]

TLS1.3 support is announced in Plesk Obsidian Change Log for Plesk

 

[learning_curve]

@Dukemaster We're assuming that you're not (yet) using Obsidian on your live server, as it's still very early in the Plesk development curve?

Regardless, this is an easy to understand and follow option for all: Generate Mozilla Security Recommended Web Server Configuration Files Simply alter the variables, to suit your own current setup, test and then apply. It's worth noting this page too: Weak ciphers listed in report that are not impl... | Qualys Community as one or two ciphers may appear as "weak" on Qualys during tests, but still appear okay elsewhere at present. Note FWIW: TLSv1.0 and TLSv1.1 as both are no longer supported now by many, for security concerns, especially with regard to taking online payments etc.

 

[learning_curve]

@Dukemaster There's lots of additional / other online posts but this: TLS1.3 - OpenSSLWiki should be a useful one too for you.

 

[Dukemaster]

Thank you very much for all answers and good advices.