From f93ff28c627c0f9198be88dcd605078e059bd24a Mon Sep 17 00:00:00 2001 From: Jan Tojnar Date: Sat, 23 Feb 2019 09:43:36 +0100 Subject: [PATCH] nixos/nginx: Enable TLS 1.3 support --- nixos/doc/manual/release-notes/rl-1903.xml | 3 +++ nixos/modules/services/web-servers/nginx/default.nix | 4 ++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/nixos/doc/manual/release-notes/rl-1903.xml b/nixos/doc/manual/release-notes/rl-1903.xml index 1b99724c6bc..db77724507d 100644 --- a/nixos/doc/manual/release-notes/rl-1903.xml +++ b/nixos/doc/manual/release-notes/rl-1903.xml @@ -645,6 +645,9 @@ This may break some older applications that still rely on those symbols. An upgrade guide can be found here. + + The nginx package now relies on OpenSSL 1.1 and supports TLS 1.3 by default. You can set the protocols used by the nginx service using . + diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix index 6c733f093ba..569ed5a4e25 100644 --- a/nixos/modules/services/web-servers/nginx/default.nix +++ b/nixos/modules/services/web-servers/nginx/default.nix @@ -479,8 +479,8 @@ in sslProtocols = mkOption { type = types.str; - default = "TLSv1.2"; - example = "TLSv1 TLSv1.1 TLSv1.2"; + default = "TLSv1.2 TLSv1.3"; + example = "TLSv1 TLSv1.1 TLSv1.2 TLSv1.3"; description = "Allowed TLS protocol versions."; };