1

How can I disable SSLv1, SSLv2 and SSLv3 protocols on Apache 2.4.9 installed on a Windows Server 2008 R2 as a service? (I am not using IIS.)

I still want to have TLSv1.2 protocol on my server.

Here are some of my environment variables:

SERVER_SOFTWARE                          Apache/2.4.9 (Win32) PHP/5.5.12 OpenSSL/1.0.1g 
SSL_PROTOCOL                             TLSv1.2 
Registered Stream Socket Transports      tcp, udp, ssl, sslv3, sslv2, tls

2 Answers 2

2

In conf.d/ssl.conf, conf/extra/httpd-ssl.conf, or wherever else you have your mod_ssl settings configured:

SSLProtocol All -SSLv2 -SSLv3

SSLv1 isn't a thing in mod_ssl. The All directive is a shortcut for +SSLv2 +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2, hence the manual removal of v2 and v3.

6
  • does this mean I should add SSLProtocol All -SSLv2 -SSLv3 inside this block <VirtualHost _default_:443> in the httpd-ssl.conf file? which will remove SSLv2 and SSLV3 and leaves the TLSv* open?
    – Mike
    Jan 20, 2015 at 18:47
  • You can do it globally or modify it individually for Virtualhosts, your choice.
    – Hyppy
    Jan 20, 2015 at 18:52
  • How can I do it Globally?
    – Mike
    Jan 20, 2015 at 18:53
  • In conf.d/ssl.conf, conf/extra/httpd-ssl.conf, or wherever else you have your mod_ssl defaults configured. Probably the second one.
    – Hyppy
    Jan 20, 2015 at 18:57
  • I am trying to make this change on a testing server. so I added SSLProtocol All -SSLv2 -SSLv3 to the file conf/extra/httpd-ssl.conf but "Registered Stream Socket Transports" still have "tcp, udp, ssl, sslv3, sslv2, tls" when looking at the php_info() file
    – Mike
    Jan 21, 2015 at 1:23
2

The Apache SSL settings have nothing to do with the PHP "Registered Stream Socket Transports". Simply put, TLSv1.1 and 1.2 aren't supported by PHP 5.5. Upgrade to PHP 5.6 and you'll see:

Registered Stream Socket Transports:
tcp, udp, unix, udg, ssl, sslv3, sslv2, tls, tlsv1.0, tlsv1.1, tlsv1.2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .