FreeBSD, NGINX and TLSv1.3

Sat, 29 Jun 2019 00:00:00 +0000

After a six months hiatus here is a new blogpost.
This saturday I finally found the time to upgrade the configuration of the server that hosts this very website.
Software stack is pretty simple: FreeBSD (version 12.0-p6),nginx (version 1.15.10) and OpenSSL (version 1.1.1a-freebsd).

Install the required software:


$ pkg install nginx-devel py36-certbot

Get a SSL certificate from letsencrypt:


$ certbot-3.6 certonly --standalone -d domain.tld -d www.domain.tld

Certfiles location is /usr/local/etc/letsencrypt/live/<domain.tld>, you might, or might not, want to move them to another directory.

nginx and TLS v1.2

Sat, 10 Aug 2013 14:03:39 +0000

Given that SSL and TLS, especially v1.0, suffer from serious security issues (e.g. https://en.wikipedia.org/wiki/Transport_Layer_Security#TLS) I thought it would be a good idea to use the latest and more secure version of it: v1.2.
On CentOS 6.4 the openssl version included is quite old and doesn’t support TLS v1.1 and 1.2.
So, first of all we have to install the latest version 1.0.1e, it can be done compiling from sources or by adding a third party repository; I chose the latter.

OpenSSL on nagg.eu

FreeBSD, NGINX and TLSv1.3

nginx and TLS v1.2