Resolved Transport security for HTTP/2 protocol with Nginx

[B4c4rd1]

Hello everybody,

I was given several complaints that some visitors can not access the pages. The following error message is displayed on google chrome:

ERR_SPDY_INADEQUATE_TRANSPORT_SECURITY

The error only occurs under http2 in connection with SSL.

To resolve the error, unsupported ciphers must be disabled.

Example:

# disable unsupported ciphers
ssl_ciphers EECDH+AESGCM:EDH+AESGCM:EECDH:EDH:!MD5:!RC4:!LOW:!MEDIUM:!CAMELLIA:!ECDSA:!DES:!DSS:!3DES:!NULL;

Is there a possibility that the option will be added in the future?

Steps to reproduce the error:

Install Windows XP in a Virtual Environment. Download the google chrome browser and go to the encrypted page with enabled http/2 and ssl.

 

[UFHH01]

Hi B4c4rd1,

Is there a possibility that the option will be added in the future?

Could you pls. be more specific "which option" you desire in the future?
It's up to each customer, which cipher suites he/she uses. Plesk just provides some standarts, but which cipher suites are used is a totally unqiue customer decision.

We use for example the recommended ciphers lists from Mozilla ( Intermediate ) on our servers ( with an "A+" rating for all (sub)domains ):

=> https://wiki.mozilla.org/Security/Server_Side_TLS / https://mozilla.github.io/server-side-tls/ssl-config-generator/

Example:

ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS

... but you could be as well interested in the Cloudflare cipher suites suggestions/usage:

=> https://support.cloudflare.com/hc/en-us/articles/200933580

Example:

EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5

I suggest to use the Qualys SSL Labs - Test site at => https://www.ssllabs.com/ssltest/ , to simulate quite a lot of handshakes, with different cipher suites. When you are satisfied with the results, consider to visit:

=> HTTP/2 Support in Plesk ( Plesk Onyx - online documentation - Administrator's Guide )​

... and inform yourself about the possible configuration options.

 

[B4c4rd1]

Thanks for the last link. He did well. Thank you. Why is this not implemented if it with the standard configuration to fail with older browsern?