/ Register

Get the most out of your Centmin Mod LEMP stack
Become a Member

Nginx Nginx ssl cipher suite

Discussion in 'Centmin Mod Insights' started by rdan, Jul 7, 2014.

Tags:
Previous Thread Next Thread
Loading...
Page 4 of 5
  1. May 17, 2015 #61
    rdan

    rdan Well-Known Member

    5,426
    1,389
    113
    May 25, 2014
    Ratings:
    +2,172
    Local Time:
    4:14 AM
    Mainline
    10.2
  2. May 17, 2015 #62
    rdan

    rdan Well-Known Member

    5,426
    1,389
    113
    May 25, 2014
    Ratings:
    +2,172
    Local Time:
    4:14 AM
    Mainline
    10.2
    Just trying to have to have ChaCha20-Poly1305 working :|
     
  3. May 17, 2015 #63
    eva2000

    eva2000 Administrator Staff Member

    50,919
    11,804
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +18,262
    Local Time:
    6:14 AM
    Nginx 1.25.x
    MariaDB 10.x
    well i know that patch doesn't work for me on 1.02a
     
  4. May 17, 2015 #64
    rdan

    rdan Well-Known Member

    5,426
    1,389
    113
    May 25, 2014
    Ratings:
    +2,172
    Local Time:
    4:14 AM
    Mainline
    10.2
    If you spare time, can you point to me the right package? :|
    Maybe using another repo/branch of openssl that support ChaCha20..
     
  5. May 17, 2015 #65
    eva2000

    eva2000 Administrator Staff Member

    50,919
    11,804
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +18,262
    Local Time:
    6:14 AM
    Nginx 1.25.x
    MariaDB 10.x
  6. May 17, 2015 #66
    rdan

    rdan Well-Known Member

    5,426
    1,389
    113
    May 25, 2014
    Ratings:
    +2,172
    Local Time:
    4:14 AM
    Mainline
    10.2
  7. May 17, 2015 #67
    rdan

    rdan Well-Known Member

    5,426
    1,389
    113
    May 25, 2014
    Ratings:
    +2,172
    Local Time:
    4:14 AM
    Mainline
    10.2
    Since it has different file name, file content and extension.
    I'm confuse a little bit on what files to modify on centmin.
     
  8. May 17, 2015 #68
    eva2000

    eva2000 Administrator Staff Member

    50,919
    11,804
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +18,262
    Local Time:
    6:14 AM
    Nginx 1.25.x
    MariaDB 10.x
    nope remove official one, then manually download (openssl 1.02a chacha one) it in tar.gz format to /svr-setup and rename it to same format as official openssl 1.02a and just recompile Nginx via centmin.sh menu option 4

    basically rename the chacha20 package tar.gz and directory to openssl-1.02a equivalent so centmin.sh sees it as just normal openssl-1.02a i.e. rename to openssl-1.0.2a.tar.gz
     
  9. May 17, 2015 #69
    rdan

    rdan Well-Known Member

    5,426
    1,389
    113
    May 25, 2014
    Ratings:
    +2,172
    Local Time:
    4:14 AM
    Mainline
    10.2
    Thanks a lot :|
    Can you please give the right cipher?
    I don't want to support older browser/system, just want to have performance :)
     
  10. May 17, 2015 #70
    eva2000

    eva2000 Administrator Staff Member

    50,919
    11,804
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +18,262
    Local Time:
    6:14 AM
    Nginx 1.25.x
    MariaDB 10.x
  11. May 17, 2015 #71
    rdan

    rdan Well-Known Member

    5,426
    1,389
    113
    May 25, 2014
    Ratings:
    +2,172
    Local Time:
    4:14 AM
    Mainline
    10.2
    So the config should be?
     
  12. May 17, 2015 #72
    eva2000

    eva2000 Administrator Staff Member

    50,919
    11,804
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +18,262
    Local Time:
    6:14 AM
    Nginx 1.25.x
    MariaDB 10.x
    that's first 3 ciphers as example but there's the whole list after that so that ain't the whole cipher list. Just take existing cipher list and add 2 chacha ones to front
     
  13. May 17, 2015 #73
    rdan

    rdan Well-Known Member

    5,426
    1,389
    113
    May 25, 2014
    Ratings:
    +2,172
    Local Time:
    4:14 AM
    Mainline
    10.2
    I'm sorry but I'm confuse :/
    Can you please list the one's you use here? If possible.
     
  14. May 17, 2015 #74
    eva2000

    eva2000 Administrator Staff Member

    50,919
    11,804
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +18,262
    Local Time:
    6:14 AM
    Nginx 1.25.x
    MariaDB 10.x
    cipher list from Nginx HTTPS / SSL Google SPDY configuration add the 2 in front

    Code:
    ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA:!CAMELLIA;
     
  15. May 17, 2015 #75
    rdan

    rdan Well-Known Member

    5,426
    1,389
    113
    May 25, 2014
    Ratings:
    +2,172
    Local Time:
    4:14 AM
    Mainline
    10.2
    So as long as the .tar.gz file and openssl-1.0.2a folder is there (/svr-setup/) it will not be overwritten with default openssl every nginx upgrade?
     
  16. May 17, 2015 #76
    eva2000

    eva2000 Administrator Staff Member

    50,919
    11,804
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +18,262
    Local Time:
    6:14 AM
    Nginx 1.25.x
    MariaDB 10.x
    centmin.sh only downloads new one if version number is different in centmin.sh or if .tar.gz doesn't exist. If replaced one has same name, centmin.sh skips download
     
  17. May 17, 2015 #77
    rdan

    rdan Well-Known Member

    5,426
    1,389
    113
    May 25, 2014
    Ratings:
    +2,172
    Local Time:
    4:14 AM
    Mainline
    10.2
  18. May 17, 2015 #78
    eva2000

    eva2000 Administrator Staff Member

    50,919
    11,804
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +18,262
    Local Time:
    6:14 AM
    Nginx 1.25.x
    MariaDB 10.x
    yeah that works or just download tar.gz one
    Code:
    wget https://github.com/PeterMosmans/openssl/archive/1.0.2-chacha.tar.gz
     
  19. May 17, 2015 #79
    rdan

    rdan Well-Known Member

    5,426
    1,389
    113
    May 25, 2014
    Ratings:
    +2,172
    Local Time:
    4:14 AM
    Mainline
    10.2
  20. May 17, 2015 #80
    eva2000

    eva2000 Administrator Staff Member

    50,919
    11,804
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +18,262
    Local Time:
    6:14 AM
    Nginx 1.25.x
    MariaDB 10.x
Previous Thread Next Thread
Loading...
Page 4 of 5

.