Lesson 4.5: Reviewing a TLS configuration
A TLS configuration ages quietly: TLS 1.0 and 1.1 were formally deprecated in 2021 (RFC 8996), yet old servers still accept them because nobody changed the line written years ago. Cryptography 101 checked one server's certificate and protocol; this lesson reviews and fixes a whole configuration. In the lab you probe which protocol versions Northwind's partner portal accepts, read its nginx TLS settings, move it to a modern profile based on Mozilla's recommendations, and confirm the old versions are refused while modern clients still connect.
15 min
You will learn to
- Probe accepted TLS versions with s_client
- Read nginx TLS directives
- Explain why TLS 1.0/1.1 are deprecated
- Apply a modern protocol and cipher profile
- Verify the result
Key terms
- Protocol version
- TLS 1.0/1.1 (deprecated, RFC 8996), TLS 1.2 (still fine when configured well), TLS 1.3 (current).
- Cipher suite
- In TLS 1.2: key exchange + authentication + cipher + MAC, e.g. ECDHE-RSA-AES256-GCM-SHA384.
- Forward secrecy
- Ephemeral (EC)DHE keys: stealing the server key later doesn't decrypt recorded sessions.
- AEAD
- Authenticated encryption (AES-GCM, ChaCha20-Poly1305): encryption and integrity in one construction.
- Mozilla TLS profiles
- Maintained recommendations: modern (TLS 1.3 only), intermediate (TLS 1.2+), old.
← Password policy and breached passwords · All lessons · Stolen sessions: MFA bypass with AiTM phishing and infostealers →