Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to ensure PCI compliance by limiting mod_ssl to SSLv3 and TLSv1, and ensuring long keys. I've tried the following configuration, but certain combinations of SSLv2 seems to still be valid:

SSLCipherSuite HIGH:MEDIUM:!aNULL:+SHA1:+MD5:+HIGH:+MEDIUM

What should the SSLCipherSuite configuration look like to completely disable SSLv2 and meet the PCI requirements?

share|improve this question

3 Answers 3

up vote 3 down vote accepted

This is what I currently use for a PCI compliant Apache configuration:

SSLProtocol all -SSLv2
SSLCipherSuite ALL:!EXP:!NULL:!ADH:!LOW
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* - [F]
share|improve this answer
    
The userdir module also needs to be disabled. It seems to be loaded by default on Ubuntu and Debian. –  Roy Sep 24 '10 at 17:42
    
As noted by Mat, the rewrite rules can be replaced with "TraceEnable Off" on Apache 2.x –  Roy Sep 24 '10 at 17:47
    
Would it be better to disable all and specifically enable TLSv1 and SSLv3, rather than enable all and disable SSLv2? –  Roy Sep 24 '10 at 17:48
    
Same difference. httpd.apache.org/docs/2.0/mod/mod_ssl.html#sslprotocol You could argue disable all would be a better approach. However, new protocols are likely to be more secure rather than less. –  Warner Sep 24 '10 at 17:57

If you have Apache 2.0+ you can avoid the rewrite rules that Warner mentioned and replace them with just:

TraceEnable Off
share|improve this answer

The protocols can be disabled with the SSLProtocol statement as such:

SSLProtocol -ALL +SSLv3 +TLSv1
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.