My domain is: https://dev.www.triunfamos.com I ran this command: I use Advanced Rest Client ( https://install.advancedrestclient.com/install ) and call to my domain It produced this output: ### The requested URL can't be reached The service might be temporarily down or it may have moved permanent…

Resume: For nginx 1.10.x the ssl_ecdh_curve sentence must be removed (if I use ARC) from nginx configuration. For nginx 1.11 the ssl_ecdh_curve must set auto In sites which has nginx 1.10 but is working ARC is due to is using cloudflare SSL It is adviced to install TLS 1.3 for nginx 1.11 Thanks…

try: grep -r ssl_ecdh_curve /etc/nginx

@jmorahan root@profuniv-desa:/etc/nginx# grep -r ssl_ecdh_curve * snippets/ssl_letsencrypt.conf:ssl_ecdh_curve secp384r1;

Okay so try editing the file snippets/ssl_letsencrypt.conf and changing that line from: ssl_ecdh_curve secp384r1; to: ssl_ecdh_curve auto; or possibly just delete the line entirely.

[image] jmorahan: Maybe it shouldn’t, but I’m looking at the handshake in Wireshark and I’m only seeing secp256r1 being offered by ARC. Uch, seriously? IMHO that's a flaw from ARC..

changed to ssl_ecdh_curve auto; root@profuniv-desa:/etc/nginx# nginx -t nginx: [emerg] Unknown curve name "auto" (SSL:) nginx: configuration file /etc/nginx/nginx.conf test failed Suggestion (some sites): Don’t works: https://www.cdn77.com/tls-test?domain=dev.www.triunfamos.com DO works: https:/…

Yeah sorry I misread the documentation, auto was added in a later nginx version than the one you’re running. Try just deleting the line entirely.

YOU ARE THE FUCKING MASTER. It worked by deleting the entire line. So… the question is: Is the change favorable or worst?

[image] nacesprin: changed to ssl_ecdh_curve auto; root@profuniv-desa:/etc/nginx# nginx -t nginx: [emerg] Unknown curve name "auto" (SSL:) nginx: configuration file /etc/nginx/nginx.conf test failed auto only works since nginx 1.11.0. Try: ssl_ecdh_curve prime256v1:secp384r1; That might b…

root@profuniv-desa:/etc/nginx# nginx -t nginx: [emerg] Unknown curve name "prime256v1:secp384r1" (SSL:) nginx: configuration file /etc/nginx/nginx.conf test failed

[image] Osiris: ssl_ecdh_curve prime256v1:secp384r1; As I've said before I'm not an nginx expert... but my reading of the docs is that that syntax is also only supported since 1.11.0. [image] nacesprin: So… the question is: Is the change favorable or worst? Well, strictly speaking it'…

Cannot use Advanced Rest Client with Letsencrypt Websites because throws: sslv3 alert handshake failure

Help

jmorahan March 7, 2019, 9:49pm 24

TLS 1.3 is good, but it will also require you to upgrade nginx

Topic		Replies	Views
Android 7.0 can't establish ssl connection Help	10	7532	June 18, 2021
Certificate verify failed (existing self-signed certificate) Help	13	11539	December 3, 2015
SSLHandshakeException Java7 version 1.7.0_241 Help	8	2213	February 10, 2020
Unclear motive for negative server responses Help	57	5135	November 28, 2021
Https://check-your-website.server-daten.de/?q=ggc.world : fatal error: No https - result with http-status 200, no encryption Help	2	778	March 12, 2020

Cannot use Advanced Rest Client with Letsencrypt Websites because throws: sslv3 alert handshake failure

Related topics