Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Server using Apache and Plesk 9.

I have set-up multiple domains each with its own IP for SSL. Each domain has its own SSL config file /var/www/vhosts/mydomain/conf/vhost_ssl.conf

I have disabled SSLv2 in /etc/httpd/conf.d/ssl.conf and checked it with

openssl s_client –ssl2 –connect localhost:443 result is an error.. which is correct

However when i test the domain to see if SSLv2 is disabled

openssl s_client –ssl2 –connect mydomain:443 result is domain has SSLv2 support - not what i want

My question is... Do i have to add lines to /var/www/vhosts/mydomain/conf/vhost_ssl.conf to disable SSLv2 support for that domain...?

Is yes, do i need to copy the full <VirtualHost _default_:443>....</VirtualHost> section form /etc/httpd/conf.d/ssl.conf and add it to /var/www/vhosts/mydomain/conf/vhost_ssl.conf ?

share|improve this question

2 Answers 2

I'm afraid so, the attribute change in the default vhost won't transfer to the rest of the VirtualHost.

However since you want the same SSL config for all of them what I would do if I were you is to keep the SSL settings in a separate file and then Include the file inside each vhost.

<VirtualHost xxx:443>
   ServerName yyy
   Include ssl_paramters.conf
</VirtualHost>
share|improve this answer
    
Thanks for the answer, so just to make 100% sure for my small brain. xxx:443 would be mydomains_ip_address:443 and yyy would be mydomain.com The file ssl_paramters.conf will be in /etc/httpd/conf.d/ –  Colin009 Feb 13 '11 at 15:51
    
Correct xxx would be the IP address, yyy the domain name (also ServerAlias if you need any) and the ssl_parameters.conf will be in /etc/httpd/conf.d –  lynxman Feb 13 '11 at 16:19

Add the following to your global configuration.

# enable only secure protocols: SSLv3 and TLSv1, but not SSLv2
SSLProtocol all -SSLv2

You may also want this.

#   SSL Cipher Suite:
#   List the ciphers that the client is permitted to negotiate.
#   See the mod_ssl documentation for a complete list.
#   enable only secure ciphers:
SSLCipherSuite HIGH:MEDIUM:!ADH
#   Use this instead if you want to allow cipher upgrades via SGC facility.
#   In this case you also have to use something like
#        SSLRequire %{SSL_CIPHER_USEKEYSIZE} >= 128
#   see http://httpd.apache.org/docs/2.2/ssl/ssl_howto.html.en#upgradeenc
#SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
share|improve this answer
    
The key here is putting this in the GLOBAL configuration (outside all vhosts) –  voretaq7 Feb 14 '11 at 0:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.