# Secure Renegotiation IS NOT supported et No ALPN negotiated

**URL:** <https://www.debian-fr.org/t/secure-renegotiation-is-not-supported-et-no-alpn-negotiated/87121>\
**Category:** Support Debian\
**Created:** [Septembre 10, 2022, 5:52 UTC](https://www.debian-fr.org/t/secure-renegotiation-is-not-supported-et-no-alpn-negotiated/87121 "2022-09-10T05:52:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ignace1972](https://www.debian-fr.org/user_avatar/www.debian-fr.org/ignace1972/32/12214_2.png) [@ignace1972](https://www.debian-fr.org/u/ignace1972)\
**Post date:** [Septembre 10, 2022, 5:52 UTC](https://www.debian-fr.org/t/secure-renegotiation-is-not-supported-et-no-alpn-negotiated/87121/1 "2022-09-10T05:52:22Z")

</div>

Bonjour à tous et à toutes.  
Quand je fais : `openssl s_client -connect ignace72.eu:443`  
Dans la sortie, j’ai :

```auto
    New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 384 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)

```

Quelqu’un peut me dire ce j’ai fait de mal pour avoir :  
Secure Renegotiation IS NOT supported  
Compression: NONE  
No ALPN negotiated

J’utilise Nginx 1.18 et un certificat Let’s Encrypt.

Ma configuration SSL de Nginx :

```auto
   server {
    server_name ignace72.eu;
    listen 443 ssl http2;

    ssl_protocols TLSv1.3;
ssl_certificate /etc/letsencrypt/live/ignace72.eu/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/ignace72.eu/privkey.pem; # managed by Certbot
    ssl_trusted_certificate /etc/letsencrypt/live/ignace72.eu/chain.pem;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
	add_header X-Frame-Options "SAMEORIGIN";
	add_header X-XSS-Protection "1; mode=block";
    ssl_ecdh_curve secp384r1;
    ssl_ciphers EECDH+AESGCM:EECDH+CHACHA20:EECDH+AES;
    ssl_prefer_server_ciphers on;
	ssl_stapling on;
    ssl_stapling_verify on;
    resolver 1.1.1.1 1.0.0.1 valid=300s;
    resolver_timeout 5s;
    ssl_session_cache shared:SSL:10m;
	ssl_session_timeout 5m;

```

Merci à vous.

---

<div class="post-metadata">

**Author:** ![Zargos](https://www.debian-fr.org/user_avatar/www.debian-fr.org/zargos/32/10889_2.png) [@Zargos](https://www.debian-fr.org/u/Zargos)\
**Post date:** [Septembre 10, 2022, 10:36 UTC](https://www.debian-fr.org/t/secure-renegotiation-is-not-supported-et-no-alpn-negotiated/87121/2 "2022-09-10T10:36:12Z")

</div>

Ca arrive avec l’utilisation de `Strict-Transport-Security` il me semble.  
utilise:  
`openssl s_client -connect ignace72.eu:443 -alpn h2`

Pour la partie Secure Renegotiation, ca a été desactivé par defaut dans OpenSSL, car il y a une faille dans toutes les versions de TLS.  
Il y a quatre mode de renegotiation, deux coté client, deux coté serveur.  
La seule méthode viable est d’avoir la même des deux coté.

---

<div class="post-metadata">

**Author:** ![ignace1972](https://www.debian-fr.org/user_avatar/www.debian-fr.org/ignace1972/32/12214_2.png) [@ignace1972](https://www.debian-fr.org/u/ignace1972)\
**Post date:** [Septembre 10, 2022, 4:13 UTC](https://www.debian-fr.org/t/secure-renegotiation-is-not-supported-et-no-alpn-negotiated/87121/3 "2022-09-10T16:13:38Z")

</div>

Bonjour, Zargos.  
Donc tout va bien ? Je n’ai pas à m’inquiéter .  
Avec ta commande, j’ai :  
`ALPN protocol: h2`  
Merci à toi pour tes explications.

---

<div class="post-metadata">

**Author:** ![Zargos](https://www.debian-fr.org/user_avatar/www.debian-fr.org/zargos/32/10889_2.png) [@Zargos](https://www.debian-fr.org/u/Zargos)\
**Post date:** [Septembre 22, 2022, 9:55 UTC](https://www.debian-fr.org/t/secure-renegotiation-is-not-supported-et-no-alpn-negotiated/87121/4 "2022-09-22T09:55:04Z")

</div>

De rien 🙂