Testing and Enabling TLS 1.3 for grommunio

WalterH

If you check the grommunio server’s web interface using the Qualys SSL Test, you’ll often find that TLS 1.3 isn’t supported.

The Qualys SSL Test However, you can also use any other SSL test.

The message displayed when TLS 1.3 is not supported:

This is a characteristic of older nginx versions; any server that supports HTTPS (ports 443 and 8443) requires the same ssl_protocols settings. This restriction has been removed in newer nginx versions, such as the one included with openSUSE 16.0.

This server supports TLS 1.3:

If TLS 1.3 is already supported, no changes are necessary.

Read Part 2 to learn how to add the ssl_protocols setting for the second server entry.

WalterH

To enable TLS 1.3, it usually helps to add the ssl_protocols line to the second server entry. To do this, create the file /etc/grommunio-common/nginx/ssl_wh.conf - the easiest way is to paste these 3 lines in the console:

echo "# WH - enable TLSv1.3" > /etc/grommunio-common/nginx/ssl_wh.conf
echo "ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;" >> /etc/grommunio-common/nginx/ssl_wh.conf
echo "#" >> /etc/grommunio-common/nginx/ssl_wh.conf

Then restart nginx with systemctl restart nginx and test again by clicking “Clear Cache”.

TLS 1.3 should now be supported.

Additional Information:

You can also use the command line to check whether TLS 1.3 is enabled:
echo "Q" | openssl s_client -connect localhost:443 -tls1_3
A message containing Protocol : TLSv1.3 should then appear, such as:

Note about openSUSE 16.0 update:

Before updating to openSUSE 16.0, delete the file: /etc/grommunio-common/nginx/ssl_wh.conf using the command
rm -f /etc/grommunio-common/nginx/ssl_wh.conf. Nginx on openSUSE 16.0 is newer and does not require this modification.

Enjoy grommunio

amaccuish

For me I needed to symlink the file in to /etc/nginx/conf.d

WalterH

amaccuish Can you elaborate and post the command?

PiotrPan

Thanks for the hint.... but if you care for v1.3 I would remove depcreated ones. If you have clients requiring <TLS1.2 the issue is the client side.

a good ressource is also https://configurator.tlsref.org/

But in case you follow the configs, mind commenting out /etc/grommunio-common/nginx/ssl_params.conf as some configs are duplicate which prevent nginx's start.

sslscan on clientside might easy up checking for those minding openssl -connect stuff, as it easily shows the result, though not as nice as ssllabs. But supports other prococols and non standard ports.