use openssl to disable weak tls versions in apache

Use openssl to disable weak tls versions in apache update#

Nmap -script ssl-enum-ciphers -p 443 | grep TLSv If not, consider creating your own config file with your SSLProtocol settingĪnd including it in this first virtual host config, and possibly all virtualĪs mentioned by others, the configuration you want is SSLProtocol TLSv1.2Īfter you make your change, you can quickly confirm it via: systemctl reload apache2 If you’re running Apache server you will need to tweak the Apache/httpd configuration file in order to disable TLS 1.0 and 1.1 One thing to keep on mind is that if you have any control panel interface/gui like cPanel/Plesk you must tweak the configuration file from the control panel or the changes will be reverted. Otherwise, it's likely that setting it in your ssl.conf file would work.ĭ. If not, but you find it includes a config file that is setting SSLProtocol,Ĭ. If you find that config file explicitly sets SSLProtocol, make your change there.ī. Inspect the configuration for that virtual host carefully.Ī. Determine the first virtual host on the given port. For example, if you've used the Let's Encrypt installer, it often adds these:

This can be important if your configuration has Include directives.

Use openssl to disable weak tls versions in apache update#

When you see this, you might find that it's sufficient to update the SSLProtocol config for just that 'default server' virtual host.Īnother complication that you might run in to with earlier suggestions is that if you grep for occurrences of SSLProtocol in your /etc/apache2/ or /etc/httpd/ tree, you will not find configuration in other parts of your file system. Port 443 namevhost (/etc/apache2/sites-enabled/:2) When you do this you should see a list of the virtual hosts and it might include a 443 section something like *:443 is a NameVirtualHostĭefault server (/etc/apache2/sites-enabled/:2)

On CentOS, only one line will probably be needed: httpd -t -D DUMP_VHOSTS To determine the first virtual host: bash even if its configuration doesn't explicitly specify a SSLProtocol value. The following suggestions were tested on Ubuntu 16.04 Apache 2.Ī key observation is that the first virtual host on that port dictates the setting. Note: if you have many weak ciphers in your SSL auditing report, you can quickly reject them adding ! at the beginning.There are a lot of fine answers here, but they did not work for me or were actually overkill. Save the configuration file and restart apache server SSLCipherSuite HIGH:!MEDIUM:!aNULL:! MD5:!RC4 SSLProtocol +TLSv1.1 +TLSv1.2 If you could afford it you can remove the TLS1.1 as well and keep only TLSv1.2 ( By doing this you can disable the SSLV2, SSLv3) Set your Protocols to accept only TLSV1.2 and TLSv1.1. SSLCipherSuite EECDH+AESGCM:EDH+AESGCM Requires Apache 2.4.36 & OpenSSL 1.1.1 SSLProtocol -all +TLSv1.3 +TLSv1.2 SSLOpenSSLConfCmd Curves.Modify SSLCipherSuite directive in nf as below to accept only higher encryption algorithms.Go to conf folder of your web server (or) edit your virtual host file.RC4 & MD5 cipher algorithms are considered vulnerable ciphers. So it’s important to configure SSL Cipher and enable above TLS 1.1 & TLS 1.1, which is stronger and not vulnerable. It’s based on your web server SSL Cipher configuration and strong protocol that allows data encryption to take place. Data encryption is the process of converting plain text into secret ciphered codes. SSL Cipher is an encryption algorithm, which is used as a key between two computers over the Internet.