up vote 3 down vote favorite
2
share [g+] share [fb]

I need to ensure PCI compliance by limiting mod_ssl to SSLv3 and TLSv1, and ensuring long keys. I've tried the following configuration, but certain combinations of SSLv2 seems to still be valid:

SSLCipherSuite HIGH:MEDIUM:!aNULL:+SHA1:+MD5:+HIGH:+MEDIUM

What should the SSLCipherSuite configuration look like to completely disable SSLv2 and meet the PCI requirements?

link|improve this question
100% accept rate
feedback

3 Answers

up vote 3 down vote accepted

This is what I currently use for a PCI compliant Apache configuration:

SSLProtocol all -SSLv2
SSLCipherSuite ALL:!EXP:!NULL:!ADH:!LOW
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* - [F]
link|improve this answer
The userdir module also needs to be disabled. It seems to be loaded by default on Ubuntu and Debian. – Roy Sep 24 '10 at 17:42
As noted by Mat, the rewrite rules can be replaced with "TraceEnable Off" on Apache 2.x – Roy Sep 24 '10 at 17:47
Would it be better to disable all and specifically enable TLSv1 and SSLv3, rather than enable all and disable SSLv2? – Roy Sep 24 '10 at 17:48
Same difference. httpd.apache.org/docs/2.0/mod/mod_ssl.html#sslprotocol You could argue disable all would be a better approach. However, new protocols are likely to be more secure rather than less. – Warner Sep 24 '10 at 17:57
feedback
up vote 3 down vote

If you have Apache 2.0+ you can avoid the rewrite rules that Warner mentioned and replace them with just:

TraceEnable Off
link|improve this answer
feedback
up vote 1 down vote

The protocols can be disabled with the SSLProtocol statement as such:

SSLProtocol -ALL +SSLv3 +TLSv1
link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.