NGINX 101: Web Traffic Encryption with SSL/TLS and NGINX

NGINX 101: Managing SSL/TLS ROBERT HAYNES

| ©2021 F5 2 Agenda TLS/SSL Overview Introduction TLS Protocols Cyphers Key Exchange Encryption Certificates Basic NGINX Config Demo NGINX SSL Configuration Extras Next Redirecting HTTP to HTTPS Recommended SSL settings Additional NGINX security offers

| ©2021 F5 7 10000 Ft (3048m) View THIS IS WHAT WE ARE TRYING TO ACHIEVE Client Server Key Algorithm Key Algorithm Matching key and encryption algorithm Identity confirmed, connection established, encryption of traffic between client and server.

| ©2021 F5 11 CONFIDENTIAL Creating a Shared Key Identity and capabilities Key ‘exchange’ Server Client ECDHE-RSA-AES256-GCM-SHA384 Public Value Public Value Random Secret Random Secret Public Value Public Value Public Value Public Value Intermediate Intermediate

| ©2021 F5 14 CONFIDENTIAL Protocol == Control of Operations THE SSL/TLS PROTOCOL SETTING IS THE CONTROL STREAM Identity and capabilities Key ‘exchange’ Bulk encryption Server Client SSL1 SSL2 SSL3 TLS1 TLS1.1 TLS1.2 TLS1.3

| ©2021 F5 15 Eliminates known insecure key ciphers Mandates forward secrecy Mandates more secure bulk encryption Signs whole handshake CONFIDENTIAL Why Use TLS 1.3? LATEST AND GREATEST SAFER Reduced handshakes in TLS session setup 0-RTT connections for session resumption Simpler cipher suites, fewer possible combinations FASTER 63% of Servers prefer TLS 1.3* *F5 TLS Telemetry report 2021

| ©2021 F5 17 CONFIDENTIAL What is an SSL Certificate used for? Establish Identity Certificate contains identity information and is signed by a trusted Certificate Authority Signing Communications A client can verify that data was sent from the server by using the public key in the SSL certificate to decrypt it

| ©2021 F5 18 CONFIDENTIAL SSL for Identity Verification Certificate from NGINX.com Root Certificate Authority (Balitmore Cybertrust) Intermediate Certificate (Cloudflare.com) Signs Signs Certificate Chain

| ©2021 F5 19 CONFIDENTIAL Certificates Self Signed CA Signed Self CA Signed Generate your own Obtain from a CA Create your CA Create your cert Certificate Warnings No warnings No warnings on browsers with your root CA Dev/Test Production Internal prod/QA

| ©2021 F5 21 CONFIDENTIAL NGINX Config Overview http{ # HTTP block sets global http values server { # server block defines an individual config } upstream { # upstream block defines backend servers } } Server and upstream blocks are usually contained in separate files and incorporated using the include directive

| ©2021 F5 22 CONFIDENTIAL NGINX SSL Configuration server { listen 443 ssl; server_name www.example.com; ssl_certificate ssl/www.example.com.crt; ssl_certificate_key ssl/www.example.com.key; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers HIGH:!aNULL:!MD5; ssl_conf_command Ciphersuites TLS_CHACHA20_POLY1305_SHA256; … Server Name – needs to match certificate* SSL Certificate and key name Allowable protocols Cipher string for for TLS 1.2 Port to listen on and protocol Cipher string for TLS 1.3

| ©2021 F5 23 CONFIDENTIAL ssl_ciphers Explained HIGH:!aNULL:!MD5; Use the high strength set of ciphers Explicitly exclude (!) any cipher suite offering no authentication Explicitly exclude (!) any cipher suite using MD5 for hashing See what cipher strings will be listed: openssl ciphers -V 'HIGH:!aNULL:!MD5'

| ©2021 F5 24 CONFIDENTIAL ssl_conf_command Ciphersuites TLS_CHACHA20_POLY1305_SHA256 Protocol Bulk Encryption Key Derivation TLS 1.3 has 5 recommended cipher suites (37 in TLS1.2),(319 for backward compatibility!)

| ©2021 F5 28 CONFIDENTIAL Redirect HTTP to HTTPS server { listen 80; listen [::]:80; server_name example.com www.example.com; return 301 https://example.com$request_uri; } Add an additional server block listening on port 80, and return a HTTP redirect response to any request:

| ©2021 F5 29 CONFIDENTIAL Improving SSL Security - Key Exchange Parameters Increase the size of one of the known parameters to 4096 bytes: Generate the key: SSL_Demo> sudo openssl dhparam -out /etc/nginx/ssl/dhkey4096.pem 4096 Add the value to the NGINX config: ssl_certificate www.example.com.crt; ssl_certificate_key www.example.com.key; ssl_dhparam /etc/ssl/dhkey4096.pem;

| ©2021 F5 30 Add Strict Transport Security headers: add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; This informs a browser that a site should ONLY be accessed over HTTPS. Increase the timeout and set a session cache ssl_session_cache shared:SSL:10m; ssl_session_timeout 10m; CONFIDENTIAL Additional Security and Performance Settings

| ©2021 F5 32 NGINX App Protect DoS Protection against a range of DoS attacks, including hard-to-spot low and slow attacks NGINX App Protect WAF Powerful defense against layer 7 attacks Based on F5’s leading application layer firewall NGINX Kubernetes Ingress Controller Ingress control for Kubernetes, with added encryption, authentication and WAF. CONFIDENTIAL NGINX Security Products BUILT ON NGINX PLUS

| ©2021 F5 34 CONFIDENTIAL Useful Resources Private Keys https://www.nginx.com/blog/secure-distribution-ssl-private-keys-nginx/ Cipher Suites https://www.youtube.com/watch?v=ZM3tXhPV8v0 Key Exchange https://www.youtube.com/watch?v=pa4osob1XOk TLS 1.3 https://www.nginx.com/blog/nginx-plus-r17-released/#r17-tls13

NGINX 101: Web Traffic Encryption with SSL/TLS and NGINX

NGINX 101: Web Traffic Encryption with SSL/TLS and NGINX

In this document

More Related Content

What's hot

Similar to NGINX 101: Web Traffic Encryption with SSL/TLS and NGINX

More from NGINX, Inc.

Recently uploaded

NGINX 101: Web Traffic Encryption with SSL/TLS and NGINX