3

I have some problems with enabling SSLv3 in my Nginx Ingress used as a Minikube addon. I have read in docs how to do it. It should be as simple as adding single map. Unfortunately I haven't had much success with it. It added this map in both namespaces - kube-system and the second one in which ingress is created.

kind: ConfigMap
apiVersion: v1
metadata:
  name: nginx-config
data:
  ssl-ciphers: "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA"
  ssl-protocols: "SSLv2 SSLv3 TLSv1 TLSv1.1 TLSv1.2 TLSv1.3"

I did it separately and even forced nginx-ingress-controller but nothing happened. I have also found out about nginx-load-balancer-conf ConfigMap in kube-system namespace and added the same entries there too, but it didn't help either.

ssl-protocols seems to be one of few properties which can be defined in ConfigMap but no by annotations.

So my question is: Am I making some kind of stupid mistake or Minikube requires some different configuration?

I'm checking result of my actions by testssl.sh.

@Update I have listed my ingress controller config and there is my list of enabled ssl-protocols containing all I lisited, so I guess config is read, but not used. I have also read the logs but there is no errors there suggesting that for some reason SSLv3 cannot be used.

user@server:~$ kubectl exec -it -n kube-system nginx-ingress-controller-658b646bc5-4h562 cat /etc/nginx/nginx.conf | grep ssl
            is_ssl_passthrough_enabled = false,
        listen_ports = { ssl_proxy = "442", https = "443" },
    ssl_protocols SSLv2 SSLv3 TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.