TLS 1.3 and ssl_reject_handshake

Maxim Dounin mdounin at
Wed Dec 23 16:39:17 UTC 2020


On Sat, Dec 19, 2020 at 05:04:36AM -0500, graxlop wrote:

> I'm using nginx 1.19.6 and when enabling "ssl_reject_handshake" in the top
> server block, it will disable TLS 1.3 if no certificate is included in the
> same server block or in the http block.
>     server {
>         listen       443 ssl;
>         ssl_reject_handshake on;
>     }
>     server {
>         listen       443 http2 ssl;
>         server_name;
>         root         /home/test;
>         ssl_certificate      ssl/rsa.crt;
>         ssl_certificate_key  ssl/rsa.key;
>     }

This is a bug in OpenSSL.  This bug is already fixed and the fix 
is expected to be available in the next OpenSSL release.  Details 
can be found here:

The most simple workaround is to define a dummy certificate for 
the server block with ssl_reject_handshake.  This certificate 
won't be used, but will prevent OpenSSL from incorrectly disabling 

Maxim Dounin

More information about the nginx mailing list