Symptoms
-
All websites are not accessible with 502 Bad gateway
- At Tools & Settings > TLS versions and ciphers management > TLS versions and ciphers by Mozilla the modern ciphers are set:
Cause
TLS version discrepancy in Modern TLS versions and ciphers by Mozilla ciphers set within SSLit! extension. This is considered as bug #PPPM-13038 which will be fixed in future Plesk updates.
The following error could be found in the nginx log error files:
CONFIG_TEXT: 44231#0: *4 SSL_do_handshake() failed (SSL: error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version:SSL alert number 70) while SSL handshaking to upstream
CONFIG_TEXT: # nginx -t
nginx: [emerg] SSL_CTX_set_cipher_list("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256") failed (SSL: error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match)
nginx: configuration file /etc/nginx/nginx.conf test failed
Resolution
As a workaround:
- Log in to Plesk
- Go to Tools & Settings > TLS versions and ciphers management > TLS versions and ciphers by Mozilla
- Switch cipher suite to Intermediate:
- Click Change & Sync button to apply changes
Add TLSv1.3 into proxy_ssl_protocols in /etc/nginx/conf.d/ssl.conf
Comments
0 comments
Please sign in to leave a comment.