Table of Contents

Ubuntu - nginx - Disable SSLv3 in Nginx (protect against the POODLE vulnerability)

SSL 3.0 is an obsolete and insecure protocol recently affected by the POODLE (Padding Oracle On Downgraded Legacy Encryption) vulnerability which allows a man-in-the-middle attacker to decrypt ciphertext using a padding oracle side-channel attack.

SSLv3 has been replaced by TLS which is supported by all modern browsers so it should be safe to disable SSLv3.

Here’s how to identify sites supporting SSLv3 and disable it.

Get a list of all sites supporting SSLv3

grep -r ssl_protocol /etc/nginx

This will give you a list of the sites currently supporting SSLv3: 

/etc/nginx/sites-available/default:#    ssl_protocols SSLv3 TLSv1;
/etc/nginx/sites-enabled/mysite.com:        ssl_protocols  SSLv3 TLSv1;

Edit each Config file

Open each file in a text editor. (Example: vi /etc/nginx/sites-available/default)

Replace this line: 

ssl_protocols SSLv3 TLSv1;

with: 

ssl_protocols TLSv1.2 TLSv1.1 TLSv1;

Restart Nginx

/etc/init.d/nginx restart