No replies to this topic

[PixelToast]

I was wondering what http library CC uses, it looks like it is outdated as it cant connect to my webserver over https ( https://pxtst.com/ )
here are my ssl settings:

listen 443 default_server;
	listen [::]:443 default_server;
	ssl_protocols TLSv1.2TLSv1.2;
	ssl_dhparam /var/www/dhparams.pem;
	ssl_ciphers AES256+EECDH:AES256+EDH:!aNULL;
ssl_prefer_server_ciphers on;
ssl_stapling on;
ssl_stapling_verify on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
add_header Strict-Transport-Security "max-age=31536000;";
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
gzip off;
add_header Public-Key-Pins 'pin-sha256="YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg="; pin-sha256="igoT8vBaS0NBnAz3Adc/BWPegCWNGdylWjSJ+4CVxCs="; max-age=2592000;';
	ssl on;
	ssl_certificate /etc/letsencrypt/live/pxtst.com/fullchain.pem;
	ssl_certificate_key /etc/letsencrypt/live/pxtst.com/privkey.pem;

so presumably its because it doesnt support AES256+EECDH or AES256+EDH
i guess i will have to add back some weak ciphers (but i dont know which ones)

EDIT:

looks like the main issue was forcing TLSv1.2 (all major browsers support this, apparently not CC)
it works now

also it looks like this is just a java 7 issue, tls 1.2 and high security ciphers are only supported on java 8

Edited by PixelToast, 27 February 2016 - 09:04 PM.