STIGQter: STIG Summary: F5 NGINX Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 25 Nov 2025:

NGINX must be configured to use FIPS-approved algorithms to protect the confidentiality and integrity of transmitted information.

DISA Rule

SV-278405r1171967_rule

Vulnerability Number

V-278405

Group Title

SRG-APP-000439

Rule Version

NGNX-APP-001960

Severity

CAT II

CCI(s)

• CCI-002418 - Protect the confidentiality and/or integrity of transmitted information.
• CCI-001941 - Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts.
• CCI-001184 - Protect the authenticity of communications sessions.
• CCI-001199 - Protects the confidentiality and/or integrity of organization-defined information at rest.
• CCI-001967 - Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
• CCI-002421 - Implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission.
• CCI-002420 - Maintain the confidentiality and/or integrity of information during preparation for transmission.
• CCI-002422 - Maintain the confidentiality and/or integrity of information during reception.
• CCI-002450 - Implement organization-defined types of cryptography for each specified cryptography use.
• CCI-003123 - Implement organization-defined cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.

Weight

10

Fix Recommendation

Restrict TLS versions to FIPS-approved protocols:

ssl_protocols TLSv1.2 TLSv1.3;

Configure only FIPS compliant ciphers:

ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';

Do not allow clients to select the ciphers:

ssl_prefer_server_ciphers on;

Restart NGINX to apply changes:

sudo nginx -t && sudo systemctl reload nginx

Check Contents

Determine the path to NGINX config file(s):

nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Examine the SSL configuration settings:

grep -R 'ssl_' /etc/nginx/nginx.conf

Verify TLS versions:

ssl_protocols TLSv1.2 TLSv1.3;

Verify cipher suites:

ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
ssl_prefer_server_ciphers on;

Note: The cipher list can be more restrictive if defined by the organization.

If non-FIPS ciphers or weak protocols (e.g., TLSv1.0/1.1, RC4, MD5, 3DES) are present, this is a finding.

Vulnerability Number

V-278405

Documentable

False

Rule Version

NGNX-APP-001960

Severity Override Guidance

Determine the path to NGINX config file(s):

nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Examine the SSL configuration settings:

grep -R 'ssl_' /etc/nginx/nginx.conf

Verify TLS versions:

ssl_protocols TLSv1.2 TLSv1.3;

Verify cipher suites:

ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
ssl_prefer_server_ciphers on;

Note: The cipher list can be more restrictive if defined by the organization.

If non-FIPS ciphers or weak protocols (e.g., TLSv1.0/1.1, RC4, MD5, 3DES) are present, this is a finding.

Check Content Reference

M

Target Key

5720