up vote 2 down vote favorite
1
share [g+] share [fb]

I'm running Apache2 with SSL on Ubuntu 10.04LTS. Chrome gives me this annoying warning when I inspect the certificate:

The connection had to be retried using SSL 3.0. This typically means that the server is using very old software and may have other security issues.

The relevant part of the apache config looks like:

SSLEngine on
SSLCertificateFile /etc/ssl/...
SSLCertificateKeyFile /etc/ssl/...
SSLCACertificateFile /etc/ssl/...
SSLProtocol -all +SSLv3 +TLSv1

The last line I added to try to address this problem, but it's not working. Any advice on properly enabling TLS?

link|improve this question
56% accept rate
Do you have an SSLCipherSuite directive? Also, where's the certificate from? And does the cert have anything else strange going on like, say, an MD5 hash or chain validation issues? – Shane Madden Jun 15 '11 at 0:13
Can you try with just SSLProtocol -all +TLSv1? – Bruno Jun 15 '11 at 13:01
I'm having the same problem as Leopd. When I remove SSLv3, Chrome doesn't load the page at all -- something about a cipher mismatch. In addition to the SSLProtocol line that Leopd uses, I'm using SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:!LOW:!SSLv2:!EXP – Greg Jul 6 '11 at 20:53
I have exactly the same problem. Anybody find a solution on this ? I have a ubuntu 11.04 with a fresh installation. – Richard Feb 21 at 4:42
feedback

1 Answer

up vote 1 down vote

I came across this page when searching for the Chrome warning (I've just started playing with apache), the exact same thing was happening to me with a fresh apache install.

You have to make sure your SSLCipherSuite directive includes 'TLSv1', as it doesn't by default.

This along with the SSLProtocol directive in your question removed all warnings about the connection to the site, even with a self-signed certificate (when i say "removed all warnings about the connection to the site", the certificate warnings were still present, but the encryption messages were fine).

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.