From 15603ba9e87cf2476f7ef842307e1d7bdfbf0e61 Mon Sep 17 00:00:00 2001 From: Alan Orth Date: Sat, 6 Dec 2014 22:37:00 +0300 Subject: [PATCH] roles/nginx: Disable SSL session tickets Session tickets increase performance, but decrease security, so let's just turn them off. See the following posts: - https://timtaubert.de/blog/2014/11/the-sad-state-of-server-side-tls-session-resumption-implementations/ - https://www.imperialviolet.org/2013/06/27/botchingpfs.html - https://github.com/igrigorik/istlsfastyet.com/blob/master/nginx/includes/ssl.conf Signed-off-by: Alan Orth --- roles/nginx/templates/https.j2 | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/roles/nginx/templates/https.j2 b/roles/nginx/templates/https.j2 index 10d5849..9c3b52c 100644 --- a/roles/nginx/templates/https.j2 +++ b/roles/nginx/templates/https.j2 @@ -14,6 +14,15 @@ ssl_ciphers "{{ tls_cipher_suite }}"; ssl_prefer_server_ciphers on; + # nginx does not auto-rotate session ticket keys: only a HUP / restart will do so and + # when a restart is performed the previous key is lost, which resets all previous + # sessions. The fix for this is to setup a manual rotation mechanism: + # http://trac.nginx.org/nginx/changeset/1356a3b9692441e163b4e78be4e9f5a46c7479e9/nginx + # + # Note that you'll have to define and rotate the keys securely by yourself. In absence + # of such infrastructure, consider turning off session tickets: + ssl_session_tickets off; + # Enable this if you want HSTS (recommended, but be careful) add_header Strict-Transport-Security max-age=15768000;