Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

At application level there is sometimes no (easy) way to, say, disable SSLv2 etc. What about at openssl level (of course for applications that use the openssl shared libs) ?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

Generally speaking, it is possible to compile OpenSSL without SSLv2 support, but then you may have to re-compile most (if not all) of the application relying on it. I believe the Ubuntu guys do something similar. If you think going this way, it may be simpler to just patch your application to use SSLv3 or TLSv1.

According to this blog post your other options are application-specific configuration (if your application supports it), or the use of stunnel.

Other than that, I'm not aware of any other option to disable specific SSL versions or algorithms.

share|improve this answer

I do it with apache config: In my VirtualHost thise code enables only SSL3 but disable everything else f.e. TLS and SSL2.

   SSLEngine on
   SSLProtocol -all +SSLv3
   SSLCipherSuite SSLv3:+HIGH:+MEDIUM:+LOW:+EXP
   SSLCertificateFile /usr/local/etc/apache22/ssl/my.pem
   SSLCertificateKeyFile /usr/local/etc/apache22/ssl/my.key 
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.