Simple SPDY implementation not working

May 1, 2015 2.8k views
Nginx System Tools Ubuntu
walk
By:
walk

Hello,

Wonder if you could help - I'm having an issue where the instructions to just 'flip the spdy switch' aren't working for me.

Here's the setup:

Ubuntu 12.04 LTS
Nginx 1.7.12 (upgraded today from Ubuntu mainline/dev PPA - includes ssl modules)
OpenSSL 1.0.1 (build from 19/03/15 - upgraded today)
Have restarted Dovecot/Postfix/PHP5-FPM/Monit and of course Nginx.

Spdycheck.org is showing no spdy due to no NPN (but this version of openssl supports it, checked changelog), the Chrome/FF extensions also reporting no spdy. SSL Labs are reporting 'No' for NPN.

Also trying to get HSTS working with no joy either. Using the line below.

Where am I going wrong?

I have included the following in the sites-enabled host file, for the https server block:

listen 443 ssl spdy default_server;

[servername, limitcon, log, keepalive_timeout, ssl certs...]

addheader Strict-Transport-Security "max-age=31536000; includeSubDomains";
addheader Alternate-Protocol 443:npn-spdy/3;
I'm seeing nothing about the latter two headers in the Network section of the Chrome/FF [F12] profilers.

Thanks!

--
This is a a new thread based on comment here

Log In to Comment
4 Answers
jtittle1 May 3, 2015

@walk

Here's a quick copy & paste from a template we've been using. The top is the http block, followed by the server block. All you should need to do is copy & paste in the differences. Also at the very top is how to get the dhparam.pem generated so you can set that as well.

http://hastebin.com/xijeneberi.nginx

Reply
walk May 5, 2015

Thanks for sharing that, @jtittle - I took the parts I didn't have yet (stapling, the 'ssl on' line) and re-ordered the headers so that the Alternate-Protocol came before the STS line. Nothing changed. It's still not being read by nginx.

Something in my config is either overriding it or getting there first.

SSL Labs still reporting no HSTS, no stapling, no NPN (thus, no spdy!).

Error logs only showing some md5 cache collisions - will keep looking.

Reply
walk May 5, 2015

For info, this is the version of openssl being used:

https://launchpad.net/ubuntu/+source/openssl/1.0.1-4ubuntu5.25

Reply
walk May 5, 2015

UPDATE:

Fixed / resolved / working - rebooting the server fixed it. Restarting each service individually didn't work. I might have missed one, despite restarting mysql, ssh, nginx etc. etc.

Now HSTS etc. all working too. No idea why they wouldn't work previously.

Reply
Have another answer? Share your knowledge.

Related Questions