Just starting out with managing an Apache server. Running into some issues while trying to integrate with a vendor API. I've verified all of the basic infrastructure issues (DNS, TCP ports, etc.) and have begun to suspect that SSL is the problem. The vendor API is configured to use DES-CBC3-SHA as its SSL cipher suite. I've verified that my host is able to complete the handshake using a manual connection via:
openssl s_client -ssl3 -connect vendor.somehost.com:443
I get the expected handshake and cert in the response. However, when I attempt connection through my application, I get a timeout. The application is RoR using Phusion Passenger. I have the following line in my httpd.conf:
SSLCipherSuite RC4-SHA:HIGH:!ADH:!AES256-SHA:!ECDHE-RSA-AES256-SHA384:!AES128-SHA:!DES-CBC3-SHA:!DES-CBC3-MD5:!IDEA-CBC-SHA:!RC4-MD5:!IDEA-CBC-MD5:!RC2-CBC-MD5:!MD5:!aNULL:!EDH:!AESGCM SSLHonorCipherOrder on
This is intended to mitigate the BEAST vulnerability by restricting apache to stream rather than block ciphers. I'm curious if the apache settings are affecting the ability for outbound SSL connections to negotiate a 3DES cipher suite if they're restricted per the above.
A final sundry: Verified chain of trust for vendor's API (trust CA certs, intermediate CAs, etc.) Verified specific SSL/TLS protocol versions Application level stuff like passwords/tokens have all been confirmed