<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body dir="auto"><div dir="auto">We had this problem in Ubuntu's repos until we rebuilt against newer OpenSSL and the TLS 1.3 variables were exposed to NGINX at build time - then you could turn it off in ssl_protocols by not specifying TLSv1.3.</div><div dir="auto"><br></div><div dir="auto">However, your case indicates that you are linked (compiled) against older LibreSSL than you are running. NGINX can't know what newer items are available without a recompile. This applies to OpenSSL as well. Its not just what version of the SSL libraries you are running - its what version of the libs you compiled with as well.</div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto"><br></div><div id="composer_signature" dir="auto"><div style="font-size:85%;color:#575757" dir="auto">Sent from my Sprint Samsung Galaxy Note10+.</div></div><div dir="auto"><br></div><div><br></div><div align="left" dir="auto" style="font-size:100%;color:#000000"><div>-------- Original message --------</div><div>From: nginx@bartelt.name </div><div>Date: 11/29/20 10:01 (GMT-05:00) </div><div>To: nginx@nginx.org </div><div>Subject: nginx 1.18.0 implicitly enables TLS 1.3 (with only "ssl_protocols
TLSv1.2; " in nginx.conf config) </div><div><br></div></div>Hello,<br><br>I've noticed that nginx 1.18.0 always enables TLS 1.3 even if not <br>configured to do so. I've observed this behavior on OpenBSD with (nginx <br>1.18.0 linked against LibreSSL 3.3.0) and on Ubuntu 20.04 (nginx 1.18.0 <br>linked against OpenSSL 1.1.1f). I don't know which release of nginx <br>introduced this bug.<br><br> From nginx.conf:<br>ssl_protocols TLSv1.2;<br>--> in my understanding, this config statement should only enable TLS <br>1.2 but not TLS 1.3. However, the observed behavior is that TLS 1.3 is <br>implicitly enabled in addition to TLS 1.2.<br><br>Best regards<br>Andreas<br><br># nginx -V<br>nginx version: nginx/1.18.0<br>built with LibreSSL 3.2.2 (running with LibreSSL 3.3.0)<br>_______________________________________________<br>nginx mailing list<br>nginx@nginx.org<br>http://mailman.nginx.org/mailman/listinfo/nginx<br><br></body></html>