# Certbot uses weak ciphers on nginx **URL:** \ **Category:** Server\ **Created:** [December 30, 2017, 7:33am UTC](https://community.letsencrypt.org/t/certbot-uses-weak-ciphers-on-nginx/49232 "2017-12-30T07:33:48Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Nicolas](https://avatars.discourse-cdn.com/v4/letter/n/67e7ee/32.png) [@Nicolas](https://community.letsencrypt.org/u/Nicolas)\ **Post date:** [December 30, 2017, 7:33am UTC](https://community.letsencrypt.org/t/certbot-uses-weak-ciphers-on-nginx/49232/1 "2017-12-30T07:33:48Z")
I’m using certbot with nginx on Ubuntu. I tested my website on [ssllabs.com](http://ssllabs.com) and it says that my server uses some weak cipher suites. In particular, the ciphers labeled as “weak” are: - TLS\_ECDHE\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA (0xc012) - TLS\_DHE\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA (0x16) - TLS\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA (0xa) I tried disabling these in my nginx.conf, but I realized that certbot is overriding the nginx.conf by including its own in `/etc/letsencrypt/options-ssl-nginx.conf`. I can manually change this by either removing certbot’s include in each server or changing this other file directly, but I am wondering if this is intended default behavior for certbot and if these ciphers really are an issue. ---
**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\ **Post date:** [December 30, 2017, 7:47am UTC](https://community.letsencrypt.org/t/certbot-uses-weak-ciphers-on-nginx/49232/2 "2017-12-30T07:47:49Z")
Certbot uses Mozilla’s “intermediate compatibility” TLS configuration. [https://wiki.mozilla.org/Security/Server\_Side\_TLS](https://wiki.mozilla.org/Security/Server_Side_TLS) It _does_ enable weak settings, but it puts them at the bottom of the list. Modern clients will use more secure settings. TLS settings can be debated, and there are a number of tradeoffs, but it’s not an egregiously terrible configuration. Still, you might prefer other settings, like Mozilla’s “modern” configuration or something else. If you want to change things, I’m unfortunately not sure what the best option is. If you edit `/etc/letsencrypt/options-ssl-nginx.conf` I don’t know if Certbot will overwrite it later. 😓 I believe it would work to remove “`include /etc/letsencrypt/options-ssl-nginx.conf`;” from the Nginx configuration and paste in equivalent settings, but I don’t know if it’s the best strategy. ---
**Author:** ![Nicolas](https://avatars.discourse-cdn.com/v4/letter/n/67e7ee/32.png) [@Nicolas](https://community.letsencrypt.org/u/Nicolas)\ **Post date:** [December 30, 2017, 8:08am UTC](https://community.letsencrypt.org/t/certbot-uses-weak-ciphers-on-nginx/49232/3 "2017-12-30T08:08:26Z")
Thank you for the info! Removing the include from the server configuration has been working for me. Perhaps customizing the cipher configuration could be an option in certbot in the future. ---
**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\ **Post date:** [December 30, 2017, 8:10am UTC](https://community.letsencrypt.org/t/certbot-uses-weak-ciphers-on-nginx/49232/4 "2017-12-30T08:10:56Z")
> [@Nicolas](#): > > Thank you for the info! Removing the include from the server configuration has been working for me. Perhaps customizing the cipher configuration could be an option in certbot in the future. Nginx's default configuration is not very good. 😬 Removing all of Certbot's settings will leave you in worse shape than leaving them unmodified. It's best to reenable Certbot's configuration, or set something else -- like Mozilla's "modern" settings -- instead. You can copy and paste straight from Mozilla's website. [https://mozilla.github.io/server-side-tls/ssl-config-generator/](https://mozilla.github.io/server-side-tls/ssl-config-generator/) ---
**Author:** ![Nicolas](https://avatars.discourse-cdn.com/v4/letter/n/67e7ee/32.png) [@Nicolas](https://community.letsencrypt.org/u/Nicolas)\ **Post date:** [December 30, 2017, 8:19am UTC](https://community.letsencrypt.org/t/certbot-uses-weak-ciphers-on-nginx/49232/5 "2017-12-30T08:19:53Z")
Thanks for the advice! I had already configured nginx before (which is why I wondered why it started using weak ciphers once I used certbot today), so when I removed certbot’s include it wasn’t using the default nginx configuration. I will also include the entries from Mozilla’s configuration. ---
**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\ **Post date:** [December 30, 2017, 8:26am UTC](https://community.letsencrypt.org/t/certbot-uses-weak-ciphers-on-nginx/49232/6 "2017-12-30T08:26:25Z")
Oh. Great. 😄 Nothing wrong with using your own settings. I just advise against the Nginx defaults. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [December 30, 2017, 10:24am UTC](https://community.letsencrypt.org/t/certbot-uses-weak-ciphers-on-nginx/49232/7 "2017-12-30T10:24:51Z")
I thought `certbot` had a setting so you could choose which Mozilla list it used, but I can’t find it in the command line option list… 😕 ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [December 30, 2017, 10:27pm UTC](https://community.letsencrypt.org/t/certbot-uses-weak-ciphers-on-nginx/49232/8 "2017-12-30T22:27:25Z")
> [@Osiris](#): > > I thought certbot had a setting so you could choose which Mozilla list it used, but I can’t find it in the command line option list… 😕 I believe we proposed that but have not implemented it yet. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [January 29, 2018, 10:27pm UTC](https://community.letsencrypt.org/t/certbot-uses-weak-ciphers-on-nginx/49232/9 "2018-01-29T22:27:25Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.