<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>If I remember correctly, the available cipher suites to NGINX are
based on what's compiled into the underlying SSL libraries that
NGINX builds against. So if the underlying OpenSSL has access to
ChaCha ciphers in its ciphers that're compiled into it, then NGINX
can utilize those ChaCha ciphers.</p>
<p>I don't believe there's explicit NGINX compile-time configuration
options to enable ciphers at runtime, as this is dependent on the
OpenSSL libraries statically built into your binaries, and
therefore whatever OpenSSL cipher suites are enabled in it. You
can then enable/disable the individual ciphers to be 'offered' by
NGINX the `ssl_ciphers` configuration parameter [1] to use ciphers
that might not be in the default cipherstring (which is
"HIGH:!aNULL:!MD5" for reference), though, which is the 'standard'
way to define what cipher suites should/shouldn't be used for SSL
in the nginx instance when it's running and serving SSL
connections. <br>
</p>
<p>Consider, though, that any ciphers you put in the cipherstring
will only be usable if the underlying SSL libraries (statically
compiled in or not) support those ciphers that are defined in the
cipher string.<br>
</p>
<p><br>
</p>
<p>Thomas</p>
<p><br>
</p>
<p>[1]:
<a class="moz-txt-link-freetext" href="http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers">http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers</a><br>
</p>
<br>
<div class="moz-cite-prefix">On 04/05/2018 11:35 AM, Neil Craig
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:D6EC00B1.FB85%25Neil.Craig@bbc.co.uk">
<!-- Template generated by Exclaimer Mail Disclaimers on 04:35:02 Thursday, 5 April 2018 -->
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css">P.4aeb0e0f-c67f-42ce-bc35-6d175fcbd3cd {
MARGIN: 0cm 0cm 0pt
}
LI.4aeb0e0f-c67f-42ce-bc35-6d175fcbd3cd {
MARGIN: 0cm 0cm 0pt
}
DIV.4aeb0e0f-c67f-42ce-bc35-6d175fcbd3cd {
MARGIN: 0cm 0cm 0pt
}
TABLE.4aeb0e0f-c67f-42ce-bc35-6d175fcbd3cdTable {
MARGIN: 0cm 0cm 0pt
}
DIV.Section1 {
page: Section1
}
</style>
<div>Hi</div>
<div><br>
</div>
<div>I build a customised nginx binary for my project, this is
statically compiled against openssl (via —with-openssl). Does
anyone know if it’s possible to add a configure option to enable
specific ciphersuites? The OpenSSL docs are here:</div>
<div><br>
</div>
<div><a
href="https://wiki.openssl.org/index.php/Compilation_and_Installation"
moz-do-not-send="true">https://wiki.openssl.org/index.php/Compilation_and_Installation</a></div>
<div><br>
</div>
<div>And these say that you can set a configure option of
“enable-<ciphersuite>” if compiling OpenSSL directly. Is
there some way I can tell the nginx build to do that?</div>
<div><br>
</div>
<div>Cheers</div>
<div>
<div><font class="Apple-style-span" color="#000000"><font
class="Apple-style-span" face="Calibri">Neil</font></font></div>
<div><br>
</div>
</div>
<p class="4aeb0e0f-c67f-42ce-bc35-6d175fcbd3cd"> </p>
<p class="4aeb0e0f-c67f-42ce-bc35-6d175fcbd3cd">----------------------------<br>
<font size="3" face="Times New Roman"><font size="3" face="Times
New Roman"><font size="3" face="Times New Roman"><br>
<font size="3" face="Times New Roman"><a
href="http://www.bbc.co.uk" target="_blank"
moz-do-not-send="true">http://www.<span class="il">bbc</span>.<span
class="il">co</span>.<span class="il">uk</span></a><br>
This e-mail (and any attachments) is confidential and
may contain personal views which are not the views of
the
<span class="il">BBC</span> unless specifically stated.<br>
If you have received it in error, please delete it from
your system.<br>
Do not use, copy or disclose the information in any way
nor act in reliance on it and notify the sender
immediately.<br>
Please note that the <span class="il">BBC</span>
monitors e-mails sent or received.<br>
Further communication will signify your consent to this.</font></font></font></font></p>
<p class="4aeb0e0f-c67f-42ce-bc35-6d175fcbd3cd">---------------------</p>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
nginx-devel mailing list
<a class="moz-txt-link-abbreviated" href="mailto:nginx-devel@nginx.org">nginx-devel@nginx.org</a>
<a class="moz-txt-link-freetext" href="http://mailman.nginx.org/mailman/listinfo/nginx-devel">http://mailman.nginx.org/mailman/listinfo/nginx-devel</a></pre>
</blockquote>
<br>
</body>
</html>