Version 2.9.20+ TLS 1.3 ?

[AlmightyJojo]

Could anyone please explain why I'm having issue enabling TLS 1.3 on any version newer than 2.9.19?

image: 'jc21/nginx-proxy-manager:latest' = 2.9.19
Yet the actual latest / newest is 2.9.22 ?

On 2.9.19 TLS 1.3 is enabled by default but using AES 128 GCM by default. If I attach volume ssl-ciphers.conf I can force TLS 1.3 AES 256 GCM.

ssl_protocols TLSv1.3; ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384;

On 2.9.22 TLS 1.2 AES 256 is used by default. Using the same ssl-ciphers.conf doesn't change it. I've reviewed the nginx.conf + proxy host confs and not sure why TLS 1.3 won't enable?

[AlmightyJojo]

Same TLS 1.2 situation with 2.10.1
Anybody know why all versions newer than 2.9.19 use TLS 1.2 and not TLS 1.3?

[stanthewizzard]

the file you are using is not used by NPM
inside the container
cd /etc/nginx/conf.d
apt update
apt install nano
nano ssl-ciphers.conf

it's not the file in the conf for the docker but internal file

[AlmightyJojo]

Thanks! File in correct directory did the trick.
In 2.9.19 I had placed it in /etc/nginx/conf.d/include/ssl-ciphers.conf (to get AES 256 enabled)

I modified compose.yml volumes to place ssl-ciphers.conf in /etc/nginx/conf.d/
2.10.1 doesn't like bind mount for ssl-ciphers.conf.
/etc/nginx/conf.d/sedxFAGxK: Device or resource busy

I found issue + a workaround here, k3d3 - #2773
Perhaps there is a more ideal solution? I'd like to bind mount and not create within container.

[stanthewizzard]

Either bug on npm or on purpos