How do I disable just one cipher out of OpenSSL TLSv1.3 list?

Question

I use Nginx + Let's Encrypt with OpenSSL on my server. I wanted to use TLSv1.2 and TLSv1.3. But I wanted to use very specific SSL ciphers. Specifically:

• TLS_AES_256_GCM_SHA384 (TLSv1.3),
• TLS_CHACHA20_POLY1305_SHA256 (TLSv1.3),
• ECDHE-RSA-AES256-GCM-SHA384 (TLSv1.2),
• ECDHE-RSA-CHACHA20-POLY1305 (TLSv1.2),
• DHE-RSA-AES256-GCM-SHA384 (TLSv1.2),
• DHE-RSA-CHACHA20-POLY1305 (TLSv1.2),

but not TLS_AES_128_GCM_SHA256 (TLSv1.3). I have done multiple configuration on Nginx configuration file to disable this cipher but it didn't work. Some of them are:

• ssl_ciphers "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305"; - Adding double quotes
• ssl_ciphers "!TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305"; - Adding ! to that cipher
• ssl_ciphers TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 - Without double quotes

So how do I achieve this? Thank you and have a nice day.

Solution

Nginx doesn't support configuring TLS 1.3 cipher suites like this, and you shouldn't, as per RFC 8446, 9.1 there are Mandatory-to-Implement Cipher Suites.

A TLS-compliant application MUST implement the TLS_AES_128_GCM_SHA256 [GCM] cipher suite and SHOULD implement the TLS_AES_256_GCM_SHA384 [GCM] and TLS_CHACHA20_POLY1305_SHA256 [RFC8439] cipher suites (see Appendix B.4).

If you really want to mess with this, you'd have to disable the mandatory cipher suite in the OpenSSL CONF library configuration files openssl.cnf as explained in e.g. Perfect 100 SSL-Labs Score Revisited:

[system_default_sect] 
MinProtocol = TLSv1.2 
CipherString = DEFAULT@SECLEVEL=2 
Ciphersuites = TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 
Options = ServerPreference,PrioritizeChaCha 
...

This will state to your OS that the minimum TLS version used is TLS1.2 and the Ciphersuites to use ar the ones specified. Please note that I have only specified TLS1.3 suites. If you need TLS1.2 support, do add "some" of them.

Comments

[Michael Hampton]

Note that if you do this, you won't be able to communicate via TLS 1.3 with a minimal TLS 1.3 implementation that only has TLS_AES_128_GCM_SHA256. I'm not aware of any such implementation right now, but there probably is one out there somewhere, maybe in IoT devices...

[Hadi]

I would try this in an hour. This looks promising. Thank you!