<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>
<div>
<div>Hi Thomas</div>
<div><br>
</div>
<div>Thanks for your reply. What you outline is essentially what I want to do – I am statically compiling nginx against a specific openssl version and I want to be able to re-enable 3DES ciphersuites which are disabled in openssl 1.1.0+ (we have some audience
demographics in e.g. Rural India and North Africa, a reasonable proportion of whom use very old mobile handsets).</div>
<div><br>
</div>
<div>So…what I would like to be able to do is to add something to my configure for nginx which would trigger the same behaviour as if I were adding “enable-<ciphersuite>” when configuring openssl.</div>
<div><br>
</div>
<div>Hopefully that makes a bit more sense now :-).</div>
<div><br>
</div>
<div>Cheers</div>
<div><br>
</div>
<div>
<div><font class="Apple-style-span" color="#000000"><font class="Apple-style-span" face="Calibri">Neil Craig</font></font></div>
<div><font class="Apple-style-span" color="#000000"><font class="Apple-style-span" face="Calibri">Lead Technical Architect</font></font></div>
<div><font class="Apple-style-span" color="#000000"><font class="Apple-style-span" face="Calibri">BBC Design + Engineering |</font></font><span style="font-family: Calibri;"> OTG</span></div>
<div><font class="Apple-style-span" color="#000000"><font class="Apple-style-span" face="Calibri">Broadcast Centre, London W12 7TQ | BC4 A3 </font></font></div>
<div><img src="cid:1470E654-D8D0-4A53-A0B0-628531702DD6" type="image/png"></div>
</div>
</div>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Thomas Ward <<a href="mailto:teward@dark-net.net">teward@dark-net.net</a>><br>
<span style="font-weight:bold">Date: </span>Thursday, 5 April 2018 at 16:56<br>
<span style="font-weight:bold">To: </span>"<a href="mailto:nginx-devel@nginx.org">nginx-devel@nginx.org</a>" <<a href="mailto:nginx-devel@nginx.org">nginx-devel@nginx.org</a>>, Neil Craig <<a href="mailto:Neil.Craig@bbc.co.uk">Neil.Craig@bbc.co.uk</a>><br>
<span style="font-weight:bold">Subject: </span>Re: Adding OpenSSL ciphersuites at compile time<br>
</div>
<div><br>
</div>
<div>
<div text="#000000" bgcolor="#FFFFFF">
<p>If I remember correctly, the available cipher suites to NGINX are based on what's compiled into the underlying SSL libraries that NGINX builds against. So if the underlying OpenSSL has access to ChaCha ciphers in its ciphers that're compiled into it, then
NGINX can utilize those ChaCha ciphers.</p>
<p>I don't believe there's explicit NGINX compile-time configuration options to enable ciphers at runtime, as this is dependent on the OpenSSL libraries statically built into your binaries, and therefore whatever OpenSSL cipher suites are enabled in it. You
can then enable/disable the individual ciphers to be 'offered' by NGINX the `ssl_ciphers` configuration parameter [1] to use ciphers that might not be in the default cipherstring (which is "HIGH:!aNULL:!MD5" for reference), though, which is the 'standard'
way to define what cipher suites should/shouldn't be used for SSL in the nginx instance when it's running and serving SSL connections.
<br>
</p>
<p>Consider, though, that any ciphers you put in the cipherstring will only be usable if the underlying SSL libraries (statically compiled in or not) support those ciphers that are defined in the cipher string.<br>
</p>
<p><br>
</p>
<p>Thomas</p>
<p><br>
</p>
<p>[1]: <a class="moz-txt-link-freetext" href="http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers">
http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers</a><br>
</p>
<br>
<div class="moz-cite-prefix">On 04/05/2018 11:35 AM, Neil Craig wrote:<br>
</div>
<blockquote type="cite" cite="mid:D6EC00B1.FB85%25Neil.Craig@bbc.co.uk"><!-- Template generated by Exclaimer Mail Disclaimers on 04:35:02 Thursday, 5 April 2018 --><style type="text/css">P.4aeb0e0f-c67f-42ce-bc35-6d175fcbd3cd {
MARGIN: 0cm 0cm 0pt
}
LI.4aeb0e0f-c67f-42ce-bc35-6d175fcbd3cd {
MARGIN: 0cm 0cm 0pt
}
DIV.4aeb0e0f-c67f-42ce-bc35-6d175fcbd3cd {
MARGIN: 0cm 0cm 0pt
}
TABLE.4aeb0e0f-c67f-42ce-bc35-6d175fcbd3cdTable {
MARGIN: 0cm 0cm 0pt
}
DIV.Section1 {
page: Section1
}
</style>
<div>Hi</div>
<div><br>
</div>
<div>I build a customised nginx binary for my project, this is statically compiled against openssl (via —with-openssl). Does anyone know if it’s possible to add a configure option to enable specific ciphersuites? The OpenSSL docs are here:</div>
<div><br>
</div>
<div><a href="https://wiki.openssl.org/index.php/Compilation_and_Installation" moz-do-not-send="true">https://wiki.openssl.org/index.php/Compilation_and_Installation</a></div>
<div><br>
</div>
<div>And these say that you can set a configure option of “enable-<ciphersuite>” if compiling OpenSSL directly. Is there some way I can tell the nginx build to do that?</div>
<div><br>
</div>
<div>Cheers</div>
<div>
<div><font class="Apple-style-span" color="#000000"><font class="Apple-style-span" face="Calibri">Neil</font></font></div>
<div><br>
</div>
</div>
<p class="4aeb0e0f-c67f-42ce-bc35-6d175fcbd3cd"> </p>
<p class="4aeb0e0f-c67f-42ce-bc35-6d175fcbd3cd">----------------------------<br>
<font size="3" face="Times New Roman"><font size="3" face="Times
New Roman"><font size="3" face="Times New Roman"><br>
<font size="3" face="Times New Roman"><a href="http://www.bbc.co.uk" target="_blank" moz-do-not-send="true">http://www.<span class="il">bbc</span>.<span class="il">co</span>.<span class="il">uk</span></a><br>
This e-mail (and any attachments) is confidential and may contain personal views which are not the views of the
<span class="il">BBC</span> unless specifically stated.<br>
If you have received it in error, please delete it from your system.<br>
Do not use, copy or disclose the information in any way nor act in reliance on it and notify the sender immediately.<br>
Please note that the <span class="il">BBC</span> monitors e-mails sent or received.<br>
Further communication will signify your consent to this.</font></font></font></font></p>
<p class="4aeb0e0f-c67f-42ce-bc35-6d175fcbd3cd">---------------------</p>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset> <br>
<pre wrap="">_______________________________________________
nginx-devel mailing list
<a class="moz-txt-link-abbreviated" href="mailto:nginx-devel@nginx.org">nginx-devel@nginx.org</a><a class="moz-txt-link-freetext" href="http://mailman.nginx.org/mailman/listinfo/nginx-devel">http://mailman.nginx.org/mailman/listinfo/nginx-devel</a></pre>
</blockquote>
<br>
</div>
</div>
</span>
</body>
</html>