Need TLSv1.3 support for nginx

[Masaya-A]

Version

2.4.120

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

RAM

Storage for /

Storage for /nsm

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

No, there are no additional clues

Detail

Hi,

Following error messages are shown when I access to SOC with firefox and edge.

Firefox: SSL_ERROR_NO_CYPHER_OVERLAP
Edge: ERR_SSL_VERSION_OR_CIPHER_MISMATCH

I found that I needed to add TLSv1.3 to nginx config.

securityonion/salt/nginx/etc/nginx.conf

Line 106 in d430dd2

ssl_protocols TLSv1.2;

This line would be ssl_protocols TLSv1.2 TLSv1.3;

Note that I'm using a cert and a key generated by Let's Encrypt, and I haven't tested using the default self-signed cert.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[dougburks]

We've created an issue for this:
#14252