On-Demand Link: https://www.nginx.com/resources/webinars/nginx-101-web-traffic-encryption-ssl-tls/ 85% of all web traffic is encrypted. This now standard practice helps ensure that data (sensitive or not) sent over the Internet remains private and out of the hands of eavesdroppers and hackers. But how do you encrypt traffic? The answer is with SSL/TLS, an encryption protocol that protects Internet communication. Join this NGINX 101 foundational webinar to learn more about the importance of and best practices for encrypting your web, application, and API traffic. Our presenters show you how to create or procure a certificate to ensure transactions are authenticated, as well as demo how straightforward it is to encrypt and secure your web traffic using NGINX. We also answer attendee questions about NGINX and encryption. Robert Haynes Technical Marketing Manager F5

1. NGINX 101:
Managing SSL/TLS
ROBERT HAYNES

2. | ©2021 F5
2
Agenda
TLS/SSL Overview
Introduction
TLS Protocols
Cyphers
Key Exchange
Encryption
Certificates
Basic NGINX Config
Demo
NGINX SSL
Configuration
Extras
Next
Redirecting HTTP to
HTTPS
Recommended SSL
settings
Additional NGINX
security offers

3. | ©2021 F5
3
>70%
10,000 busiest
websites
440M+
websites and apps
OPEN SOURCE FOOTPRINT
NGINX powers the Internet . . . and most enterprises!
PROVEN
= 1 Million

4. | ©2021 F5
4
NGINX Plus
Enterprise-Class Data Plane
NGINX Open Source
Fast, Flexible, Portable

5. | ©2021 F5
5
TLS/SSL Overview
CONFIDENTIAL

6. | ©2021 F5
6 CONFIDENTIAL
Clarifying some terms
HTTPS SSL TLS
Encrypting Web Traffic

7. | ©2021 F5
7
10000 Ft (3048m) View
THIS IS WHAT WE ARE TRYING TO ACHIEVE
Client Server
Key Algorithm Key Algorithm
Matching key and encryption algorithm
Identity confirmed, connection established, encryption of traffic between
client and server.

8. | ©2021 F5
8 CONFIDENTIAL
Establishing an encrypted connection
TCP Connection
Identity and capabilities
Key ‘exchange’
Bulk encryption
Server
Client

9. | ©2021 F5
9 CONFIDENTIAL
Establishing Capabilities and Identity
Identity and capabilities
Server
Client Supported Cypher Suites

10. | ©2021 F5
10 CONFIDENTIAL
Establishing Capabilities and Identity
Identity and capabilities
Server
Client Supported Cypher Suites
Identity
ECDHE-RSA-AES256-GCM-SHA384
RSA

11. | ©2021 F5
11 CONFIDENTIAL
Creating a Shared Key
Identity and capabilities
Key ‘exchange’ Server
Client
ECDHE-RSA-AES256-GCM-SHA384
Public Value Public Value
Random Secret Random Secret
Public Value
Public Value
Public Value
Public Value
Intermediate Intermediate

12. | ©2021 F5
12 CONFIDENTIAL
Creating a Shared Key
Identity and capabilities
Key ‘exchange’ Server
Client
ECDHE-RSA-AES256-GCM-SHA384
Random Secret Random Secret
Intermediate Intermediate

13. | ©2021 F5
13 CONFIDENTIAL
Bulk Encryption
Identity and capabilities
Key ‘exchange’
Bulk encryption
Server
Client
ECDHE-RSA-AES256-GCM-SHA384

14. | ©2021 F5
14 CONFIDENTIAL
Protocol == Control of Operations
THE SSL/TLS PROTOCOL SETTING IS THE CONTROL STREAM
Identity and capabilities
Key ‘exchange’
Bulk encryption
Server
Client
SSL1 SSL2 SSL3 TLS1 TLS1.1 TLS1.2 TLS1.3

15. | ©2021 F5
15
Eliminates known insecure key ciphers
Mandates forward secrecy
Mandates more secure bulk encryption
Signs whole handshake
CONFIDENTIAL
Why Use TLS 1.3?
LATEST AND GREATEST
SAFER
Reduced handshakes in TLS session setup
0-RTT connections for session resumption
Simpler cipher suites, fewer possible combinations
FASTER
63% of Servers prefer TLS 1.3*
*F5 TLS Telemetry report 2021

16. | ©2021 F5
16
SSL Certificates
CONFIDENTIAL

17. | ©2021 F5
17 CONFIDENTIAL
What is an SSL Certificate used for?
Establish Identity
Certificate contains identity
information and is signed
by a trusted Certificate
Authority
Signing Communications
A client can verify that data
was sent from the server
by using the public key in
the SSL certificate to
decrypt it

18. | ©2021 F5
18 CONFIDENTIAL
SSL for Identity Verification
Certificate from NGINX.com
Root Certificate Authority
(Balitmore Cybertrust)
Intermediate Certificate
(Cloudflare.com)
Signs
Signs
Certificate Chain

19. | ©2021 F5
19 CONFIDENTIAL
Certificates
Self Signed CA Signed Self CA Signed
Generate your own Obtain from a CA Create your CA
Create your cert
Certificate Warnings No warnings No warnings on
browsers with your
root CA
Dev/Test Production Internal prod/QA

20. | ©2021 F5
20
NGINX SSL
Configuration
CONFIDENTIAL

21. | ©2021 F5
21 CONFIDENTIAL
NGINX Config Overview
http{
# HTTP block sets global http values
server {
# server block defines an individual config
}
upstream {
# upstream block defines backend servers
}
}
Server and upstream
blocks are usually
contained in separate
files and incorporated
using the
include directive

22. | ©2021 F5
22 CONFIDENTIAL
NGINX SSL Configuration
server {
listen 443 ssl;
server_name www.example.com;
ssl_certificate ssl/www.example.com.crt;
ssl_certificate_key ssl/www.example.com.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_conf_command Ciphersuites TLS_CHACHA20_POLY1305_SHA256;
…
Server Name – needs to
match certificate*
SSL Certificate and key
name
Allowable protocols
Cipher string for
for TLS 1.2
Port to listen on and
protocol
Cipher string for TLS 1.3

23. | ©2021 F5
23 CONFIDENTIAL
ssl_ciphers Explained
HIGH:!aNULL:!MD5;
Use the high strength set of
ciphers
Explicitly exclude (!) any
cipher suite offering no
authentication
Explicitly exclude (!) any
cipher suite using MD5 for
hashing
See what cipher strings will be listed: openssl ciphers -V 'HIGH:!aNULL:!MD5'

24. | ©2021 F5
24 CONFIDENTIAL
ssl_conf_command Ciphersuites
TLS_CHACHA20_POLY1305_SHA256
Protocol
Bulk
Encryption
Key Derivation
TLS 1.3 has 5 recommended cipher suites (37 in TLS1.2),(319 for backward compatibility!)

25. | ©2021 F5
25
Demo Time
CONFIDENTIAL

26. | ©2021 F5
26 CONFIDENTIAL
Environment
Me
NGINX
Proxy
NGINX
Webserver
HTTPS
443
HTTPS
443
HTTP
8080

27. | ©2021 F5
27
Other Settings:
CONFIDENTIAL

28. | ©2021 F5
28 CONFIDENTIAL
Redirect HTTP to HTTPS
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
return 301 https://example.com$request_uri;
}
Add an additional server block listening on port 80, and return a HTTP redirect response to any request:

29. | ©2021 F5
29 CONFIDENTIAL
Improving SSL Security - Key Exchange Parameters
Increase the size of one of the known parameters to 4096 bytes:
Generate the key: SSL_Demo> sudo openssl dhparam -out /etc/nginx/ssl/dhkey4096.pem 4096
Add the value to the NGINX config: ssl_certificate www.example.com.crt;
ssl_certificate_key www.example.com.key;
ssl_dhparam /etc/ssl/dhkey4096.pem;

30. | ©2021 F5
30
Add Strict Transport Security headers:
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
This informs a browser that a site should ONLY be accessed over HTTPS.
Increase the timeout and set a session cache
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
CONFIDENTIAL
Additional Security and Performance Settings

31. | ©2021 F5
31
NGINX Security
Products
CONFIDENTIAL

32. | ©2021 F5
32
NGINX App Protect DoS
Protection against a range of DoS
attacks, including hard-to-spot low
and slow attacks
NGINX App Protect WAF
Powerful defense against layer 7
attacks
Based on F5’s leading application
layer firewall
NGINX Kubernetes Ingress
Controller
Ingress control for Kubernetes, with
added encryption, authentication
and WAF.
CONFIDENTIAL
NGINX Security Products
BUILT ON NGINX PLUS

33. | ©2021 F5
33
Summary
CONFIDENTIAL

34. | ©2021 F5
34 CONFIDENTIAL
Useful Resources
Private Keys
https://www.nginx.com/blog/secure-distribution-ssl-private-keys-nginx/
Cipher Suites
https://www.youtube.com/watch?v=ZM3tXhPV8v0
Key Exchange
https://www.youtube.com/watch?v=pa4osob1XOk
TLS 1.3
https://www.nginx.com/blog/nginx-plus-r17-released/#r17-tls13

35. | ©2020 F5
35
Questions?
CONFIDENTIAL