Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to ensure PCI compliance by limiting mod_ssl to SSLv3 and TLSv1, and ensuring long keys. I've tried the following configuration, but certain combinations of SSLv2 seems to still be valid:


What should the SSLCipherSuite configuration look like to completely disable SSLv2 and meet the PCI requirements?

share|improve this question
up vote 3 down vote accepted

This is what I currently use for a PCI compliant Apache configuration:

SSLProtocol all -SSLv2
RewriteEngine On
RewriteRule .* - [F]
share|improve this answer
The userdir module also needs to be disabled. It seems to be loaded by default on Ubuntu and Debian. – Roy Sep 24 '10 at 17:42
As noted by Mat, the rewrite rules can be replaced with "TraceEnable Off" on Apache 2.x – Roy Sep 24 '10 at 17:47
Would it be better to disable all and specifically enable TLSv1 and SSLv3, rather than enable all and disable SSLv2? – Roy Sep 24 '10 at 17:48
Same difference. You could argue disable all would be a better approach. However, new protocols are likely to be more secure rather than less. – Warner Sep 24 '10 at 17:57

If you have Apache 2.0+ you can avoid the rewrite rules that Warner mentioned and replace them with just:

TraceEnable Off
share|improve this answer

The protocols can be disabled with the SSLProtocol statement as such:

SSLProtocol -ALL +SSLv3 +TLSv1
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.