TLS 1.3 is a version of the Transport Layer Security (TLS) protocol that was published in 2018 as a proposed standard in RFC 8446. It offers security and performance improvements over its predecessors. TLS 1.3 now removes obsolete and insecure features from TLS 1.2, including the following SHA1, MD5, RC4, DES, 3DES, AES-CBC.

This guide will demonstrate how to enable TLS 1.3 using the Nginx web server on CentOS 8.

Requirements

  • Nginx version 1.13.0 or greater.
  • OpenSSL version 1.1.1 or greater.
  • DigitalOcean Cloud instance running CentOS 8.
  • A valid domain name and properly configured A/AAAA/CNAME DNS records for your domain.
  • A valid TLS certificate from Let's Encrypt.

Before you begin

Check the CentOS version.

cat /etc/centos-release
# CentOS Linux release 8.1.1911 (Core)

Add a new non-root user account with sudo access and switch to it.

useradd -c "John Doe" johndoe && passwd johndoe
usermod -aG wheel johndoe
su - johndoe

NOTE: Replace johndoe with your username and make sure you are using a strong password to comply with the CentOS password policy.

Set up the system’s timezone.

timedatectl list-timezones
sudo timedatectl set-timezone 'Region/City'

Ensure that your system is up to date.

sudo dnf update

Install the needed packages.

sudo dnf install -y socat git wget unzip

For simplicity, disable SELinux and Firewall.

sudo setenforce 0 ; sudo systemctl stop firewalld ; sudo systemctl disable firewalld

Install acme.sh client and obtain TLS certificate from Let's Encrypt

It is recommended to install acme.sh as root. Become a root user with su command.

sudo su - root

Install acme.sh.

git clone https://github.com/acmesh-official/acme.sh
cd acme.sh 
./acme.sh --install --accountemail your_email@example.com
cd ~
source ~/.bashrc

Check the version.

acme.sh --version
# https://github.com/acmesh-official/acme.sh
# v2.8.6

Obtain RSA and ECDSA certificates for your domain.

# RSA
acme.sh --issue --standalone -d example.com --keylength 2048
# ECC/ECDSA
acme.sh --issue --standalone -d example.com --keylength ec-256

NOTE: Replace example.com in commands with your domain name.

Create sensible directories to store your certs and keys in. We will use /etc/letsencrypt.

mkdir -p /etc/letsencrypt/example.com
mkdir -p /etc/letsencrypt/example.com_ecc

Install and copy certificates to /etc/letsencrypt.

# RSA
acme.sh --install-cert -d example.com --cert-file /etc/letsencrypt/example.com/cert.pem --key-file /etc/letsencrypt/example.com/private.key --fullchain-file /etc/letsencrypt/example.com/fullchain.pem 
# ECC/ECDSA
acme.sh --install-cert -d example.com --ecc --cert-file /etc/letsencrypt/example.com_ecc/cert.pem --key-file /etc/letsencrypt/example.com_ecc/private.key --fullchain-file /etc/letsencrypt/example.com_ecc/fullchain.pem

After running the above commands, your certificates and keys will be in the following locations:

  • RSA: /etc/letsencrypt/example.com
  • ECC/ECDSA: /etc/letsencrypt/example.com_ecc

You can now return to the normal sudo user.

exit

Install Nginx

Nginx added support for TLS 1.3 in version 1.13.0. CentOS 8 comes with Nginx and OpenSSL that support TLS 1.3 out of the box, so there is no need to build a custom version.

Install Nginx.

sudo dnf install -y nginx

Check the version.

nginx -v
# nginx version: nginx/1.14.1

Check the OpenSSL version against which Nginx was compiled.

nginx -V
# built with OpenSSL 1.1.1 FIPS  11 Sep 2018 (running with OpenSSL 1.1.1c FIPS  28 May 2019)

Start and enable Nginx.

sudo systemctl start nginx.service
sudo systemctl enable nginx.service

Configure Nginx

Now that we have successfully installed Nginx, we are ready to configure it with the proper configuration to start using TLS 1.3 on our server.

Run the sudo vim /etc/nginx/conf.d/example.com.conf command, and populate the file with the following configuration.

server {

  listen 443 ssl http2;
  listen [::]:443 ssl http2;

  server_name example.com;

  # RSA
  ssl_certificate /etc/letsencrypt/example.com/fullchain.cer;
  ssl_certificate_key /etc/letsencrypt/example.com/example.com.key;
  # ECDSA
  ssl_certificate /etc/letsencrypt/example.com_ecc/fullchain.cer;
  ssl_certificate_key /etc/letsencrypt/example.com_ecc/example.com.key;

  ssl_protocols TLSv1.3 TLSv1.2;
  
}

Save the file and exit.

Notice the new TLSv1.3 parameter of the ssl_protocols directive. This parameter is only necessary to enable TLS 1.3 on Nginx.

Check the configuration.

sudo nginx -t

Reload Nginx.

sudo systemctl reload nginx.service

To verify TLS 1.3, you can use browser dev tools or SSL Labs service. The screenshots below show Chrome's security tab.

Insert screenshot here
Insert screenshot here

You have successfully enabled TLS 1.3 in Apache on your CentOS 8 server. Just like with HTTP/2, TLS 1.3 is another exciting protocol update that we can expect to benefit from for years to come. The final version of TLS 1.3 was defined in August 2018, so there’s no better time to start embracing this technology.