Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have gPrecise Ubuntu server that has openssl 1.0.1 installed . When I try to connect to my other apache server with version 2.2.14 and openssl 0.9.8 installed , i get the below error :

:/etc/ssl# openssl s_client -connect soaprod.corp.google.com:4444 CONNECTED(00000003)

140705541154464:error:140773E8:SSL routines:SSL23_GET_SERVER_HELLO:reason(1000):s23_clnt.c:724:

no peer certificate available

No client certificate CA names sent

SSL handshake has read 7 bytes and written 225 bytes

New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE

Expansion: NONE

But if I use -tls1 or -ssl3 switch , it works fine . It seems openssl 1.0.1 is using TLSV1.1 and we need to disable it . Can you please tell how can we disable it.

share|improve this question
    
I think you have this backward: You need to enable it on the other end, by bringing it up to date. –  Michael Hampton Feb 27 at 2:19

1 Answer 1

I'm used to nginx configs, but I think you need specify protocols and cyphers in your apache config.

The following is an excerpt that is incorrect, just modify it for your purposes:

Next, open your httpd.conf or ssl.conf file and search for the SSLCipherSuite directive. If you can’t find it anywhere, you can just add it, otherwise, replace it with the following:

SSLProtocol -ALL +SSLv3 +TLSv1
SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:!LOW:!SSLv2:!EXPORT



You can tweak the directive by following themod_ssl documentation.

Taken from here: http://www.sslshopper.com/article-how-to-disable-weak-ciphers-and-ssl-2.0-in-apache.html

share|improve this answer
    
Hi Ace , I tried doing that , but that also did not work . Other question is at this point I am not using apache service and use only openssl command , but that did not work –  vis Feb 27 at 22:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.