TLS v1.3 is not working

[jebabin]

With a from scratch docker installation of NPM v2.10.2, TLS v1.3 is not working when adding a proxy host with SSL (using let's encrypt, but that should not matter)
This can be verified by testing the website with ssllabs or openssl (openssl s_client -tls1_3 -connect website:443 - no certificate will be returned)
The reason is that the directive ssl_protocols TLSv1.2 TLSv1.3; in /etc/nginx/conf.d/ssl-ciphers.conf is included in a server {} block by the server host configuration (/data/nginx/proxy_host/*.conf)
This should work according to nginx documentation (http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols) but it doesn't

A workaround is to include this directive in the http {} block by adding ssl_protocols TLSv1.2 TLSv1.3; in /data/nginx/custom/http.conf
After reloading nginx configuration, TLS v1.3 is working

The bug seems to be in nginx but I'm unsure, release notes doesn't mention any bugfix like this and latest nginx has tls 1.3 enabled by default

I think NPM should include ssl-ciphers.conf in the http {} instead of each server {} as it fix the issue and I don't see any drawback of doing it (it looks like to simplify the configuration to put this ssl settings at an higher level)
It's also interresting to note that there is a ssl_prefer_server_ciphers off; directive in ssl-ciphers.conf and a ssl_prefer_server_ciphers on; directive in the http {} block of nginx.conf. The last one should be removed.

[nietzscheanic]

the real problem is that nginx only uses the ssl_protocols directive in the server{} block of the first processed host config, which is the default config in /etc/nginx/conf.d/default.conf. in version v2.9.20 they dropped the default ssl site by using ssl_reject_handshake on in the default host config. but beside they also removed the include of conf.d/include/ssl-ciphers.conf from the default host config. that's why tlsv1.3 isn't used anymore, even like the defined cipher suites. really bad job. npm is so broken since 2023-03-16 and everyone that was pointing on this was ignored till now.

commit that broke the config -> Use ssl_reject_handshake to reject requests to default https site

i will open a pull request to fix this.

[nietzscheanic]

pull request #2932

[milouz1985]

is this bug corrected?

by adding https://github.com/NginxProxyManager/nginx-proxy-manager/blob/master/docker/rootfs/etc/nginx/conf.d/include/ssl-ciphers.conf to my npm config, when using nmap I still have TLS 1.3 disabled and TLS 1.1 and 1.0 enabled:

Am I missing something?

[milouz1985]

Arg. I figured it out. after hours, I found a comment on community.traefik.io mentioning cloudflare proxy:

https://community.traefik.io/t/why-is-this-so-difficult-disable-tls-1-0-and-1-1-w-kubernetes-ingress-traefik-2-6-3/14718/5

After setting minimum tls version to 1.2 for edge certificate on ma cloudflare account I finally get A+ grade on sslabs...
If this can help someone else...