Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running Apache2 with SSL on Ubuntu 10.04LTS. Chrome gives me this annoying warning when I inspect the certificate:

The connection had to be retried using SSL 3.0. This typically means that the server is using very old software and may have other security issues.

The relevant part of the apache config looks like:

SSLEngine on
SSLCertificateFile /etc/ssl/...
SSLCertificateKeyFile /etc/ssl/...
SSLCACertificateFile /etc/ssl/...
SSLProtocol -all +SSLv3 +TLSv1

The last line I added to try to address this problem, but it's not working. Any advice on properly enabling TLS?

share|improve this question
    
Do you have an SSLCipherSuite directive? Also, where's the certificate from? And does the cert have anything else strange going on like, say, an MD5 hash or chain validation issues? –  Shane Madden Jun 15 '11 at 0:13
    
Can you try with just SSLProtocol -all +TLSv1? –  Bruno Jun 15 '11 at 13:01
    
I'm having the same problem as Leopd. When I remove SSLv3, Chrome doesn't load the page at all -- something about a cipher mismatch. In addition to the SSLProtocol line that Leopd uses, I'm using SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:!LOW:!SSLv2:!EXP –  Greg Jul 6 '11 at 20:53
    
I have exactly the same problem. Anybody find a solution on this ? I have a ubuntu 11.04 with a fresh installation. –  user111385 Feb 21 '12 at 4:42

1 Answer 1

up vote 1 down vote accepted

I came across this page when searching for the Chrome warning (I've just started playing with apache), the exact same thing was happening to me with a fresh apache install.

You have to make sure your SSLCipherSuite directive includes 'TLSv1', as it doesn't by default.

This along with the SSLProtocol directive in your question removed all warnings about the connection to the site, even with a self-signed certificate (when i say "removed all warnings about the connection to the site", the certificate warnings were still present, but the encryption messages were fine).

I'd recommend using at least

SSLCipherSuite TLSv1+HIGH:!SSLv2:!aNULL:!eNULL:@STRENGTH
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.