<![CDATA[nginx accepts SHA-224 signature algorithms in TLS 1.2]]>On Cloudron 9.2.0 (nginx 1.24.0, OpenSSL 3.0.13) the generated vhosts pin ssl_protocols and ship a curated ssl_ciphers list, but the TLS 1.2 signature algorithms are left at OpenSSL's defaults, which still include the SHA-224 variants. A client offering nothing but ECDSA+SHA224 gets a completed handshake with Peer signature type: ecdsa_sha224.

https://en.internet.nl flags this under "Hash function for key exchange" as phase out, following the NCSC TLS guidelines 2025-05 ยง3.3.5, and notes it will likely be rated insufficient in a future update. It's the only remaining recommendation on an otherwise 100% site, and it sits in the platform's nginx configuration rather than anywhere an app or admin can reach.

Since v10 is in the works โ€” would this be worth picking up along the way?

]]>https://forum.cloudron.io/topic/15793/nginx-accepts-sha-224-signature-algorithms-in-tls-1.2RSS for NodeSun, 09 Aug 2026 05:19:56 GMTThu, 06 Aug 2026 10:36:48 GMT60<![CDATA[Reply to nginx accepts SHA-224 signature algorithms in TLS 1.2 on Sat, 08 Aug 2026 09:51:13 GMT]]>Fair enough โ€” you're right that it isn't exploitable. The client sends signature_algorithms and the server picks from the intersection, so nothing modern ends up on SHA-224 unless it explicitly asks for it, which is exactly what my test did.

Where it still bites is compliance rather than security: organisations measured against the NCSC guidelines get it reported on every scan, and internet.nl states they expect to reclassify it from phase out to insufficient in a future update โ€” at which point it stops being a recommendation and becomes a failed subtest. That's the only thing that really changes the calculus, and whether it's worth pre-empting is your call.

Same algorithm turns up on the mail server for the same reason, which is in the other thread.

]]>https://forum.cloudron.io/post/127933https://forum.cloudron.io/post/127933Sat, 08 Aug 2026 09:51:13 GMT<![CDATA[Reply to nginx accepts SHA-224 signature algorithms in TLS 1.2 on Sat, 08 Aug 2026 09:12:06 GMT]]>Since we don't set SignatureAlgorithms, the default comes from OpenSSL. It's there even in Ubuntu 26, OpenSSL 3.5.5 (27 Jan 2026).

It's not a real security issue to have SHA-224 listed since preference is mostly client driven. Most of the modern servers will have SHA-256 (or PSS, never heard of that before I researched this).

]]>https://forum.cloudron.io/post/127930https://forum.cloudron.io/post/127930Sat, 08 Aug 2026 09:12:06 GMT