STIGQter: STIG Summary: F5 NGINX Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 25 Nov 2025:

NGINX must use TLS 1.2, at a minimum, to protect data confidentiality using remote access.

DISA Rule

SV-278381r1171895_rule

Vulnerability Number

V-278381

Group Title

SRG-APP-000014

Rule Version

NGNX-APP-000040

Severity

CAT I

CCI(s)

• CCI-000068 - Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.
• CCI-001453 - Implement cryptographic mechanisms to protect the integrity of remote access sessions.

Weight

10

Fix Recommendation

Specify the allowed TLS protocols by adding the following line to the server {} block:

ssl_protocols TLSv1.2 TLSv1.3;

Restart NGINX with saved configuration:

nginx -s reload

Check Contents

Determine the path to NGINX config file(s):

nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Verify "ssl_protocols" are set to TLSv1.2 or higher:

nginx -c <path to nginx config> -qT | grep ssl_protocols
ssl_protocols TLSv1.2 TLSv1.3;

If "ssl_protocols" does not exist or does not specify TLSv1.2 or greater, this is a finding

Vulnerability Number

V-278381

Documentable

False

Rule Version

NGNX-APP-000040

Severity Override Guidance

Determine the path to NGINX config file(s):

nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Verify "ssl_protocols" are set to TLSv1.2 or higher:

nginx -c <path to nginx config> -qT | grep ssl_protocols
ssl_protocols TLSv1.2 TLSv1.3;

If "ssl_protocols" does not exist or does not specify TLSv1.2 or greater, this is a finding

Check Content Reference

M

Target Key

5720