Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I recently set up a Ubuntu 12.10 server for a service which I used to run on a 12.04 machine.

Since Ubuntu 10.10 SSLv2 seems to be disabled because of known security reasons.

If i run curl against my URL with the -1, -2 or -3 command, it works with ssl version 1 and 3. However with -2 i get curl: (4) OpenSSL was built without SSLv2 support as a response.

Now my service is working fine in all browsers, however I have problems in Java, Python and PHP.

A lot of external programs are using my API so I don't really have the possibility to upgrade the clients.

Since ssl v1 is still working, I figure it is a problem for the clients supporting only up to version 2 to recognise that verison 2 is not supported, because version 3 is announced.

Can I compile without sslv3 support? Or can I somehow safely re-enable sslv2 on ubuntu for those clients who really want it? I am now sure how relevant the security issues are, especially because openssl is used for a bunch of stuff and serving webpages is only a part...

share|improve this question
1  
Not for nothing but -1 doesn't imply sslv1 but tlsv1. TLSv1 is the successor to SSLv3. Also, I suspect that the OpenSSL message you're getting is from your client, not from your server. Unless your clients are quite old, you should be fine with sslv3/tlsv1 only, (ignoring all the vulnerabilities in those protocols for the sake of this discussion). I would focus on fixing whatever issues those java clients are experiencing with ssl3/tls1 over bringing ssl2 back. –  mahnsc Dec 12 '12 at 11:22
    
you are right! thanks. furthermore i was somehow able to fix it. i do not know what is really going on, but after forcing my systems hostname to the same hostname that is used by the client and also force it in the apache config, it somehow worked! maby some handshake issue! –  The Shurrican Dec 13 '12 at 15:14
add comment

1 Answer

I think that the errors your seeing from Curl actually relates to the client openSSL library not supporting SSLv2 rather than a problem with the server. Recent Ubuntu openSSL libraries have deprecated SSLv2 IIRC.

As to your server problem SSLv2 shouldn't be needed by any browser after Internet Explorer 5 (which was the last one that I'm aware of not to support SSLv3/TLSv1 or later)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.