<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""> TLS 1.1 and 1.2 require nginx be built against the 1.0.1 branch of OpenSSL, or the subsequent Libre and Boring forks of it. Odds are high that if you have servers running the old 0.8.x branch of nginx it is also running the old 0.9.8 branch of OpenSSL. As for whether or not it’s okay to run purely TLSv1 on the nginx 0.8.55 systems it depends on your willingness to accept the caveats that there are known and likely unknown horrors lurking in that old version of OpenSSL and the TLSv1 protocol itself is looking a bit rickety these days.<div class=""> Personally, if I’m going to run a site requiring SSL, then I’m going to do it right and not be rolling out potentially compromised libraries/protocols/ciphers.</div><div class=""><br class=""><div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><b style="color: rgb(25, 25, 25);" class=""><div style="color: rgb(0, 0, 0); font-weight: normal;" class=""><b style="color: rgb(25, 25, 25);" class=""><font face="Lucida Grande" size="2" class=""><div style="color: rgb(0, 0, 0); font-weight: normal;" class=""><b style="font-family: Helvetica; font-size: 12px; color: rgb(25, 25, 25);" class=""><div style="color: rgb(0, 0, 0); font-weight: normal;" class=""><b style="color: rgb(25, 25, 25);" class=""><div style="color: rgb(0, 0, 0); font-weight: normal;" class=""><span class="Apple-style-span" style="color: rgb(25, 25, 25); font-weight: bold;">__________________</span></div><div style="color: rgb(0, 0, 0); font-weight: normal;" class=""><div style="margin: 0px;" class=""><font class="Apple-style-span" color="#191919"><b class=""><br class=""></b></font></div><div style="margin: 0px;" class=""><font class="Apple-style-span" color="#191919"><b class="">Scott Larson</b></font></div><div style="margin: 0px;" class=""><div style="margin: 0px;" class=""><font class="Apple-style-span" color="#007EFD"><span class="Apple-style-span" style="color: rgb(0, 0, 0);"><div style="margin: 0px;" class=""><font class="Apple-style-span" color="#191919"><b class=""><div style="margin: 0px; font-weight: normal; color: rgb(120, 120, 120);" class=""><span class="Apple-style-span" style="color: rgb(25, 25, 25);"><b class=""><div style="margin: 0px; font-weight: normal; color: rgb(120, 120, 120);" class="">Systems Administrator</div></b></span></div><div style="margin: 0px; font-weight: normal; min-height: 8px;" class=""><br class=""></div><div style="margin: 0px; font-weight: normal;" class=""><b class="">Wiredrive/LA</b></div><div style="margin: 0px; font-weight: normal;" class="">310 823 8238 ext. 1106</div><div style="margin: 0px; font-weight: normal;" class="">310 943 2078 fax</div></b></font></div><div style="margin: 0px;" class=""><font class="Apple-style-span" color="#2498FC"><a href="http://www.wiredrive.com/" class="">www.wiredrive.com</a></font></div><div style="margin: 0px;" class=""><font class="Apple-style-span" color="#2498FC"><span class="Apple-style-span" style="color: rgb(0, 0, 0);"><div style="margin: 0px; color: rgb(120, 120, 120);" class=""><div style="margin: 0px;" class=""><a href="http://www.twitter.com/wiredrive" class=""><font class="Apple-style-span" color="#2498FC">www.twitter.com/wiredrive</font></a></div><div style="margin: 0px;" class=""><font class="Apple-style-span" color="#2498FC"><a href="http://www.wiredrive.com/facebook" class="">www.facebook.com/wiredrive</a></font></div></div></span></font></div></span></font></div></div></div></b></div></b></div></font></b></div></b></div></div></div></div></div></div></div>
</div>
<br class=""><div><blockquote type="cite" class=""><div class="">On Oct 24, 2014, at 9:09 AM, teddymills <<a href="mailto:nginx-forum@nginx.us" class="">nginx-forum@nginx.us</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">I have abut 10 nginx servers, versions 1.0.15 and 0.8.55.<br class=""><br class="">I am patching for the poodle, so:<br class=""><br class="">ssl_protocols TLSv1 TLSv1.1 TLSv1.2;<br class=""><br class="">is accept by nginx 1.0.15 but not 0.8.55<br class=""><br class="">I would prefer to use just TLSv1 on 0.8.55 if using just TLSv1 is okay.<br class=""><br class="">Or would upgrading the nginxs be required ? <br class=""><br class="">I dont want to upgrade the older nginx unless absolutely required.<br class=""><br class="">TIA<br class=""><br class="">Posted at Nginx Forum: <a href="http://forum.nginx.org/read.php?2,254249,254249#msg-254249" class="">http://forum.nginx.org/read.php?2,254249,254249#msg-254249</a><br class=""><br class="">_______________________________________________<br class="">nginx mailing list<br class=""><a href="mailto:nginx@nginx.org" class="">nginx@nginx.org</a><br class="">http://mailman.nginx.org/mailman/listinfo/nginx<br class=""></div></blockquote></div><br class=""></div></body></html>