← All challenges
mediumsecurity~25 min

Harden nginx TLS

The web frontend still negotiates SSLv3 and RC4, protocols broken for a decade. Restrict nginx to modern TLS, strong ciphers, and turn on HSTS.

Scenario

app.example.com terminates TLS on nginx, and the config has not been touched since the box was built. An external scan just flagged it: SSLv3 (broken by POODLE in 2014) and TLSv1.0/1.1 (deprecated by every browser) are still negotiable, the cipher list still offers RC4 and 3DES, and there is no HSTS, so one downgraded plain-HTTP request is all a man-in-the-middle needs.

Your job

Edit nginx.conf so the server block:

  • negotiates only TLSv1.2 and TLSv1.3 (ssl_protocols)
  • offers only strong ciphers: nothing from the RC4, DES/3DES, MD5, NULL, or EXPORT families (ssl_ciphers)
  • sends an HSTS header (Strict-Transport-Security) with a real max-age (a year is typical) and includeSubDomains

Leave the certificate paths and the rest of the server block alone.

How it's graded

Structural check on the directives (we read the config's shape: protocols offered, cipher families, headers set; not a live handshake). This mirrors what testssl.sh or an SSL Labs scan would verify against the running server.

Teaches: TLS server hardening, the exact items every vulnerability scan and CIS nginx benchmark opens with.

What gets checked

Your solution is verified against each of these:

  • Only TLSv1.2 and/or TLSv1.3 are enabled; no SSLv3, TLSv1, or TLSv1.1
  • The cipher list contains no broken families (RC4, DES/3DES, MD5, NULL, EXPORT)
  • A Strict-Transport-Security header with a max-age is sent

Solve it in your browser

No setup, no install. Write your solution in the editor and hit Check. The in-house engine renders and grades it instantly, then issues your proof the moment every check passes.

Solve in browser →

Prefer your own lab?

  1. Build the fix locally. New to the tooling? See setting up your lab.
  2. Push your topology file, device configs, and any playbooks to a public repo (GitHub or GitLab).
  3. Submit the repo link. We review it by hand, confirm it works, and issue your proof page.
Submit your solution →