Skip to content

Commit 0c24196

Browse files
committed
Merge branch 'update-ciphers-nginx' into 'master'
Update Ciphers Nginx The current suggested Ciphers do not qualify anymore as completely safe, see for instance [here.](https://community.qualys.com/blogs/securitylabs/2013/03/19/rc4-in-tls-is-broken-now-what) This updates the ciphers, following [Remy's advise](https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html).
2 parents ec5e905 + 8786e59 commit 0c24196

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

web-server/nginx/gitlab-ssl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ server {
4747
ssl_certificate /etc/nginx/gitlab.crt;
4848
ssl_certificate_key /etc/nginx/gitlab.key;
4949
ssl_protocols SSLv3 TLSv1 TLSv1.2;
50-
ssl_ciphers AES:HIGH:!ADH:!MD5;
50+
ssl_ciphers 'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4';
5151
ssl_prefer_server_ciphers on;
5252

5353
# individual nginx logs for this gitlab vhost

0 commit comments

Comments
 (0)