yum upgrades for production use, this is the repository for you.
Active subscription is required.
Here is the technical briefing based on the provided source summary.
Technical Briefing: Eliminating Legacy TLS Vulnerabilities and Achieving Post-Quantum Readiness in NGINX
Problem Statement
Four legacy TLS vulnerabilities—BREACH, Lucky13, SWEET32, and ROBOT—continue to dominate security scan reports for NGINX deployments. While the fixes are typically simple, they are often misapplied or missed due to configuration drift. Additionally, achieving post-quantum readiness requires specific software versions not available in standard distribution repositories.
Implementation Details
Protocol-Level Fixes (TLS 1.3-Only)
Setting ssl_protocols TLSv1.3; eliminates three of the four attacks outright at the protocol level:
– ROBOT (RSA key exchange)
– SWEET32 (3DES)
– Lucky13 (CBC ciphers)
Caveat: This configuration cuts off legacy clients, including old Java 8 and end-of-life Android versions.
Protocol-Level Fixes (TLS 1.2 + 1.3)
For fleets that must retain TLS 1.2 support, use AEAD-only and ECDHE-only ciphers:
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
This configuration must exclude:
– RSA key exchange (prevents ROBOT)
– 3DES (prevents SWEET32)
– CBC ciphers (prevents Lucky13)
Use only GCM and ChaCha20 cipher suites.
Verification Commands
- ROBOT:
openssl s_client -connect example.com:443 -tls1_2 -cipher 'AES128-GCM-SHA256:AES256-GCM-SHA384'should fail with a handshake alert. - Lucky13: Probing CBC suites (
ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256) should also fail. - SWEET32: Cannot be probed from modern OpenSSL 3.5 clients (3DES is removed client-side). Confirm the cipher list contains no 3DES suite.
BREACH Mitigation (HTTP Compression)
BREACH survives TLS 1.3 because it exploits HTTP compression above TLS. It requires three conditions:
1. Compression enabled
2. Reflected attacker input
3. A secret (e.g., CSRF token) on the same page
Critical limitation: gzip_types cannot exclude text/html—NGINX always compresses it when gzip on.
Working fix: Scoped gzip off; inside the specific location where secrets meet reflected input:
location /account/ {
gzip off;
}
Keep compression enabled elsewhere. Application-level masked per-request CSRF tokens close the hole permanently.
Post-Quantum Readiness
Add the following directive:
ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1;
Requirements:
– NGINX must be linked against OpenSSL 3.5 or later.
– Verify with: openssl s_client -connect example.com:443 -tls1_3 -groups X25519MLKEM768, expecting Negotiated TLS1.3 group: X25519MLKEM768.
Distribution limitations:
– EL 8/9 and Ubuntu 24.04 ship OpenSSL 3.0 or older.
– Only RHEL 10.1 has begun backporting ML-KEM.
NGINX-MOD from GetPageSpeed
The NGINX-MOD package links NGINX against an ABI-isolated OpenSSL 3.5 build (openssl35 package), enabling:
– Post-quantum key exchange
– HTTP/3
– Encrypted ClientHello
Available on every supported distribution.
Installation (Enterprise Linux):
sudo dnf install https://extras.getpagespeed.com/release-latest.rpm
Enable getpagespeed-extras-nginx-mod, then:
sudo dnf install nginx-mod
Installation (APT-based systems): Add the signed repository, then:
sudo apt-get install nginx-mod
This auto-swaps the stock nginx.
All configurations were runtime-tested on clean Rocky Linux 10.
Operational Caveats
- Cipher regressions creep in silently via copied vhosts, load balancers terminating TLS with their own defaults, or stale provisioning images.
- Treat TLS settings like code: Keep them in one included snippet file, not per-vhost copies.
- Rescan after every infrastructure change.
Tooling
- GetPageSpeed SSL Test: Probes all four vulnerabilities plus protocol versions, certificate chain, Encrypted ClientHello, certificate compression, and post-quantum readiness. Provides exact fix snippets.
- GetPageSpeed Amplify: Runs scheduled gixy scans across hosts. Drop-in compatible with the deprecated
nginx-amplify-agent(EOL January 2026).
Read the full article: NGINX TLS Vulnerability Fixes: BREACH, SWEET32, ROBOT
