Re: Weird proxy_ssl_protocol ordering

2017-01-13 Thread bclod
Maxim, Thanks for the detailed reply! In the organization I work for I see most legacy backends support TLSv1 or support both TLSv1.1/1.2. Since every backend that supports TLSv1.1 also supports TLSv1.2 (from my org so far) I thought I was doing a small favor by leaving TLSv1.1 out of the scope.

Re: Weird proxy_ssl_protocol ordering

2017-01-13 Thread Maxim Dounin
Hello! On Fri, Jan 13, 2017 at 12:33:16PM -0500, bclod wrote: > Hello All, > > I found some strange behavior while troubleshooting a connectivity issue > today. Below was the scenario. > > * Upstream Backend configured to allow TLSv1.1 and TLSv1.2 > * Client (nginx) configured with proxy_ssl_p

Weird proxy_ssl_protocol ordering

2017-01-13 Thread bclod
Hello All, I found some strange behavior while troubleshooting a connectivity issue today. Below was the scenario. * Upstream Backend configured to allow TLSv1.1 and TLSv1.2 * Client (nginx) configured with proxy_ssl_protocols TLSv1 TLSv1.2 No matter the ordering of nginx proxy_ssl_protocols TL