Skip to content

Commit eca3b1d

Browse files
author
Romans Malinovskis
committed
Protect against POODLE vulnerability
Ubuntu's nginx is vulnerable to POODLE. While the website https properly includes a ssl_protocol directive as recommended by https://www.digitalocean.com/community/tutorials/how-to-protect-your-server-against-the-poodle-sslv3-vulnerability the redirect code does not have the protocol set, and the website receives bad grades on https://www.ssllabs.com/ssltest/. This patch should also disable TLSv3 in redirects.
1 parent c4de3fc commit eca3b1d

1 file changed

Lines changed: 1 addition & 0 deletions

File tree

‎plugins/nginx-vhosts/post-deploy‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -154,6 +154,7 @@ server {
154154
ssl on;
155155
ssl_certificate $SSL_INUSE/server.crt;
156156
ssl_certificate_key $SSL_INUSE/server.key;
157+
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
157158
return 301 $WHERE;
158159
}
159160
EOF

0 commit comments

Comments
 (0)