{"action":"created","issue":{"url":"https://api.github.com/repos/miketheman/nginx/issues/281","labels_url":"https://api.github.com/repos/miketheman/nginx/issues/281/labels{/name}","comments_url":"https://api.github.com/repos/miketheman/nginx/issues/281/comments","events_url":"https://api.github.com/repos/miketheman/nginx/issues/281/events","html_url":"https://github.com/miketheman/nginx/issues/281","id":45840059,"number":281,"title":"Add support for defining `ssl_protocols` to mitigate POODLE","user":{"login":"sommestad","id":61638,"avatar_url":"https://avatars.githubusercontent.com/u/61638?v=3","gravatar_id":"","url":"https://api.github.com/users/sommestad","html_url":"https://github.com/sommestad","followers_url":"https://api.github.com/users/sommestad/followers","following_url":"https://api.github.com/users/sommestad/following{/other_user}","gists_url":"https://api.github.com/users/sommestad/gists{/gist_id}","starred_url":"https://api.github.com/users/sommestad/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sommestad/subscriptions","organizations_url":"https://api.github.com/users/sommestad/orgs","repos_url":"https://api.github.com/users/sommestad/repos","events_url":"https://api.github.com/users/sommestad/events{/privacy}","received_events_url":"https://api.github.com/users/sommestad/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/miketheman/nginx/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/miketheman/nginx/milestones/6","html_url":"https://github.com/miketheman/nginx/milestones/SSL","labels_url":"https://api.github.com/repos/miketheman/nginx/milestones/6/labels","id":1021531,"number":6,"title":"SSL","description":"","creator":{"login":"miketheman","id":529516,"avatar_url":"https://avatars.githubusercontent.com/u/529516?v=3","gravatar_id":"","url":"https://api.github.com/users/miketheman","html_url":"https://github.com/miketheman","followers_url":"https://api.github.com/users/miketheman/followers","following_url":"https://api.github.com/users/miketheman/following{/other_user}","gists_url":"https://api.github.com/users/miketheman/gists{/gist_id}","starred_url":"https://api.github.com/users/miketheman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/miketheman/subscriptions","organizations_url":"https://api.github.com/users/miketheman/orgs","repos_url":"https://api.github.com/users/miketheman/repos","events_url":"https://api.github.com/users/miketheman/events{/privacy}","received_events_url":"https://api.github.com/users/miketheman/received_events","type":"User","site_admin":false},"open_issues":4,"closed_issues":1,"state":"open","created_at":"2015-03-14T16:03:03Z","updated_at":"2015-05-11T06:08:12Z","due_on":null,"closed_at":null},"comments":12,"created_at":"2014-10-15T08:10:43Z","updated_at":"2015-06-15T01:53:44Z","closed_at":null,"body":"In order to mitigate the SSLv3 \"POODLE\" attack, it should be possible to define attributes for [ssl_protocols](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols) in the cookbook.\r\n\r\nPossibly like this ([inspired](https://gist.github.com/jtimberman/33b348a1f3b94051f3a2) by @jtimberman):\r\n```ruby\r\n# this is a default attribute in your cookbook's attributes/default.rb\r\nnode.override['nginx']['ssl_protocols'] = 'TLSv1 TLSv1.1 TLSv1.2'\r\n\r\n# Or, make it an array, then you can .join it...\r\nnode.override['nginx']['ssl_protocols'] = ['TLSv1', 'TLSv1.1', 'TLSv1.2']\r\n```"},"comment":{"url":"https://api.github.com/repos/miketheman/nginx/issues/comments/111898027","html_url":"https://github.com/miketheman/nginx/issues/281#issuecomment-111898027","issue_url":"https://api.github.com/repos/miketheman/nginx/issues/281","id":111898027,"user":{"login":"rmoriz","id":1527,"avatar_url":"https://avatars.githubusercontent.com/u/1527?v=3","gravatar_id":"","url":"https://api.github.com/users/rmoriz","html_url":"https://github.com/rmoriz","followers_url":"https://api.github.com/users/rmoriz/followers","following_url":"https://api.github.com/users/rmoriz/following{/other_user}","gists_url":"https://api.github.com/users/rmoriz/gists{/gist_id}","starred_url":"https://api.github.com/users/rmoriz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rmoriz/subscriptions","organizations_url":"https://api.github.com/users/rmoriz/orgs","repos_url":"https://api.github.com/users/rmoriz/repos","events_url":"https://api.github.com/users/rmoriz/events{/privacy}","received_events_url":"https://api.github.com/users/rmoriz/received_events","type":"User","site_admin":false},"created_at":"2015-06-15T01:53:44Z","updated_at":"2015-06-15T01:53:44Z","body":"As SSL/TLS by design requires custom config options on a vhost-basis (key/certificate/chains/OCSP stapling/hsts/hpkp…), why not just configure the ciphers there? While a sane global default might be nice, we can't guarantee anything. With the recent discoveries, for instance `dh_param`, admins need to take care of such things on a daily basis.\r\n\r\nAnd of course some \"secure\" settings will break older clients, e.g. Java SDKs. People need to understand this. \r\n\r\nJust defining a cipher set will IMHO only lead to a false impression of security."}}