Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I built and installed openssl 1.0.1. How do I force Apache to use TLS 1.2 Ciphers?

share|improve this question

TLS 1.2 is covered in these 2 documents;

Basically the latter doc is Prohibiting SSL 2.0 from being negotiated by TLS1.2 and this is the default for httpd 2.2 shipped with fedora; eg SSLProtocol all -SSLv2

However your question was about CipherSuites which are also covered in those docs; By the looks of it, the only mandatory cipher suite for TLS 1.2 is TLS_RSA_WITH_AES_128_CBC_SHA

Appendix C. Cipher Suite Definitions
Cipher Suite                            Key        Cipher         Mac
TLS_RSA_WITH_AES_128_CBC_SHA            RSA          AES_128_CBC  SHA

This says that the server must provide an RSA certificate for key exchange, and that the cipher should be AES_128_CBC and the Mac SHA.

From the httpd mod_ssl docs, this translates to;

 SSLCipherSuite aRSA:kRSA:AES128-CBC:SHA   

which is documented here;

share|improve this answer
After upgrading openssl from 1.0.0e to 1.0.1 and changing the SSLCipherSuite, do I need to rebuild or make any configuration tweaks to apache2? – arby Mar 24 '12 at 9:15
At a guess, I think that if you restart apache2 that if it starts then it would have upgraded OK. However I would confirm the log messages for the restart are OK. – Tom H Mar 24 '12 at 9:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.