<p>The ConfigMap and Annotation configuration have different purposes.</p>
<p>As per <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#ssl-protocols" rel="nofollow noreferrer">nginx-configuration/configmap/#ssl-protocols</a>:</p>
<blockquote>
<p>Sets the SSL <a href="http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols" rel="nofollow noreferrer">protocols</a> to use. The default is: TLSv1.2 TLSv1.3</p>
<p>ngx_http_ssl_module.html#ssl_protocols<br />
Context:  http, server</p>
</blockquote>
<p>i.e., enable the specified protocols <strong>to your Nginx Controller</strong>.</p>
<p><code>client --ssl-protocols-&gt; controller --&gt; backend</code></p>
<hr />
<p>On <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#backend-certificate-authentication" rel="nofollow noreferrer">nginx-configuration/annotations/#backend-certificate-authentication</a>, we can read:</p>
<blockquote>
<p>Enables the specified <a href="http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_protocols" rel="nofollow noreferrer">protocols</a> for requests to a proxied HTTPS server.</p>
<p>ngx_http_proxy_module.html#proxy_ssl_protocols
http, server, location</p>
</blockquote>
<p>i.e., enables the specified protocols for requests <strong>to a <a href="https://docs.nginx.com/nginx/admin-guide/security-controls/securing-http-traffic-upstream/" rel="nofollow noreferrer">proxied backend</a> using HTTPS</strong>.</p>
<p><code>client --&gt; controller --proxy-ssl-protocols-&gt; backend</code></p>
<hr />
<p>As you can see, to set the protocols served by your Nginx controller, you only have <code>http, server</code> contexts available (i.e., you can't set this to specific ingress objects).</p>

CC BY-SA 4.0
2021-04-14T13:34:00.853Z
2021-04-14T13:34:00.853Z
Eduardo Baitello
<p>I try to enable TLSv1 and TLSv1.1 for one specific ingress on a AKS cluster.</p>
<p>By default, only TLSv1.2 is enabled.</p>
<p>I don't want to apply this configuration on my all cluster, just on a specific webserver service.</p>
<p>Regarding the documentation, I need to add this annotation if I don't want to change nginx config by ConfigMap :</p>
<p><code>nginx.ingress.kubernetes.io/proxy-ssl-protocols: TLSv1 TLSv1.1 TLSv1.2</code></p>
<p>but this has no effect.</p>
<p>Is it really possible to do this by annotation ?</p>
<p>Did I do something wrong ?</p>
<p>Thank you !</p>

CC BY-SA 4.0
2021-04-12T18:08:45.193Z
Which image/tag of the ingress controller are you using?
Eduardo Baitello
CC BY-SA 4.0
2021-04-14T07:41:08.433Z
@EduardoBaitello I use this one : gcr.io/jenkinsxio/nginx-ingress-controller:0.30.0
Thanks for your reply !
benCat
<kubernetes><nginx><ingress><azure-kubernetes-service>
Enable TLSv1 TLSv1.1 for specific Ingress with Nginx Ingress
benCat
# Enable TLSv1 TLSv1.1 for specific Ingress with Nginx Ingress

(Asked by: username_0 on 2021-04-12)

I try to enable TLSv1 and TLSv1.1 for one specific ingress on a AKS cluster.

By default, only TLSv1.2 is enabled.

I don't want to apply this configuration on my all cluster, just on a specific webserver service.

Regarding the documentation, I need to add this annotation if I don't want to change nginx config by ConfigMap :

`nginx.ingress.kubernetes.io/proxy-ssl-protocols: TLSv1 TLSv1.1 TLSv1.2`

but this has no effect.

Is it really possible to do this by annotation ?

Did I do something wrong ?

Thank you !

**Tags:** kubernetes, nginx, ingress, azure-kubernetes-service

> **Comments:**
> **username_1**: Which image/tag of the ingress controller are you using?  
> **username_0**: @EduardoBaitello I use this one : gcr.io/jenkinsxio/nginx-ingress-controller:0.30.0 Thanks for your reply !  

---

## 1 answers

### Answer by username_1 on 2021-04-14. Score: 2

The ConfigMap and Annotation configuration have different purposes.

As per [nginx-configuration/configmap/#ssl-protocols](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#ssl-protocols):

> Sets the SSL [protocols](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols) to use. The default is: TLSv1.2 TLSv1.3
>
> ngx\_http\_ssl\_module.html#ssl\_protocols  
> Context: http, server

i.e., enable the specified protocols **to your Nginx Controller**.

`client --ssl-protocols-> controller --> backend`

---

On [nginx-configuration/annotations/#backend-certificate-authentication](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#backend-certificate-authentication), we can read:

> Enables the specified [protocols](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_protocols) for requests to a proxied HTTPS server.
>
> ngx\_http\_proxy\_module.html#proxy\_ssl\_protocols
> http, server, location

i.e., enables the specified protocols for requests **to a [proxied backend](https://docs.nginx.com/nginx/admin-guide/security-controls/securing-http-traffic-upstream/) using HTTPS**.

`client --> controller --proxy-ssl-protocols-> backend`

---

As you can see, to set the protocols served by your Nginx controller, you only have `http, server` contexts available (i.e., you can't set this to specific ingress objects).


---

