langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-08-25 11:59:42 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

how to close renegotiation? #4930

New Issue
Closed
opened 2026-02-21 18:08:39 -05:00 by yindo · 2 comments
yindo commented 2026-02-21 18:08:39 -05:00
Owner
Copy Link
Copy Source

Originally created by @Modas-Li on GitHub (Aug 7, 2024).

Self Checks

  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report (我已阅读并同意 Language Policy).
  • [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:）
  • Please do not modify this template :) and fill in all the required fields.

Dify version

V0.6.15

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

request for https server without renegotiation.

✔️ Expected Behavior

Steps for close renegotiation.

❌ Actual Behavior

nothing related

Originally created by @Modas-Li on GitHub (Aug 7, 2024). ### Self Checks - [X] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [X] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [X] I confirm that I am using English to submit this report (我已阅读并同意 [Language Policy](https://github.com/langgenius/dify/issues/1542)). - [X] [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:） - [X] Please do not modify this template :) and fill in all the required fields. ### Dify version V0.6.15 ### Cloud or Self Hosted Self Hosted (Docker) ### Steps to reproduce request for https server without renegotiation. ### ✔️ Expected Behavior Steps for close renegotiation. ### ❌ Actual Behavior nothing related
yindo closed this issue 2026-02-21 18:08:39 -05:00
yindo commented 2026-02-21 18:08:39 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Aug 7, 2024):

To disable renegotiation for an HTTPS server in Dify version V0.6.15, self-hosted with Docker, you need to configure the Nginx settings. Specifically, you should set the NGINX_SSL_PROTOCOLS environment variable to exclude any protocols that might allow renegotiation.

In the provided .env.example file, you can find the relevant section for Nginx configuration:

# ------------------------------
# Environment Variables for Nginx reverse proxy
# ------------------------------
NGINX_SERVER_NAME=_
HTTPS_ENABLED=false
# HTTP port
NGINX_PORT=80
# SSL settings are only applied when HTTPS_ENABLED is true
NGINX_SSL_PORT=443
# if HTTPS_ENABLED is true, you're required to add your own SSL certificates/keys to the `./nginx/ssl` directory
# and modify the env vars below accordingly.
NGINX_SSL_CERT_FILENAME=dify.crt
NGINX_SSL_CERT_KEY_FILENAME=dify.key
NGINX_SSL_PROTOCOLS=TLSv1.1 TLSv1.2 TLSv1.3

To disable renegotiation, you should ensure that only secure protocols are enabled and that the NGINX_SSL_PROTOCOLS variable is set appropriately. For example, you might want to use only TLSv1.2 and TLSv1.3:

NGINX_SSL_PROTOCOLS=TLSv1.2 TLSv1.3

Make sure to set HTTPS_ENABLED to true and provide the correct paths to your SSL certificate and key files:

HTTPS_ENABLED=true
NGINX_SSL_CERT_FILENAME=your_certificate.crt
NGINX_SSL_CERT_KEY_FILENAME=your_private_key.key

After updating the .env file, restart your Docker containers to apply the changes. This configuration will ensure that only the specified protocols are used, effectively disabling any insecure renegotiation [1].

To continue talking to Dosu, mention @dosu.

@dosubot[bot] commented on GitHub (Aug 7, 2024): <!-- Answer --> To disable renegotiation for an HTTPS server in Dify version V0.6.15, self-hosted with Docker, you need to configure the Nginx settings. Specifically, you should set the `NGINX_SSL_PROTOCOLS` environment variable to exclude any protocols that might allow renegotiation. In the provided `.env.example` file, you can find the relevant section for Nginx configuration: ```env # ------------------------------ # Environment Variables for Nginx reverse proxy # ------------------------------ NGINX_SERVER_NAME=_ HTTPS_ENABLED=false # HTTP port NGINX_PORT=80 # SSL settings are only applied when HTTPS_ENABLED is true NGINX_SSL_PORT=443 # if HTTPS_ENABLED is true, you're required to add your own SSL certificates/keys to the `./nginx/ssl` directory # and modify the env vars below accordingly. NGINX_SSL_CERT_FILENAME=dify.crt NGINX_SSL_CERT_KEY_FILENAME=dify.key NGINX_SSL_PROTOCOLS=TLSv1.1 TLSv1.2 TLSv1.3 ``` To disable renegotiation, you should ensure that only secure protocols are enabled and that the `NGINX_SSL_PROTOCOLS` variable is set appropriately. For example, you might want to use only TLSv1.2 and TLSv1.3: ```env NGINX_SSL_PROTOCOLS=TLSv1.2 TLSv1.3 ``` Make sure to set `HTTPS_ENABLED` to `true` and provide the correct paths to your SSL certificate and key files: ```env HTTPS_ENABLED=true NGINX_SSL_CERT_FILENAME=your_certificate.crt NGINX_SSL_CERT_KEY_FILENAME=your_private_key.key ``` After updating the `.env` file, restart your Docker containers to apply the changes. This configuration will ensure that only the specified protocols are used, effectively disabling any insecure renegotiation <sup>[[1]](https://github.com/langgenius/dify/blob/main/docker/.env.example)</sup>. <!-- Dosu Comment Footer --> *To continue talking to [Dosu](https://dosu.dev), mention @dosu.*
yindo commented 2026-02-21 18:08:39 -05:00
Author
Owner
Copy Link
Copy Source

@crazywoola commented on GitHub (Aug 7, 2024):

This is bug report template only. If you have questions regarding this. Please go to https://github.com/langgenius/dify/discussions

@crazywoola commented on GitHub (Aug 7, 2024): This is bug report template only. If you have questions regarding this. Please go to https://github.com/langgenius/dify/discussions
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#4930
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?