Our PCI compliance vendor requires that we disable all but RC4 encryption on our web server. Currently our apache config file looks like this: SSLHonorCipherOrder On SSLCipherSuite ...
I just tested my site on https://www.ssllabs.com/ and it said SSLv2 is insecure and I should disable that along with weak Cipher Suites. How can I disable that? I tried the following but it isn’t ...
On a CentOS LAMP box, a PCI compliance scan is failing on: Apache Shiro URI Path Security Traversal Information Disclosure http/80 As far as I can tell the server doesn't have Shiro installed, ...
From PCI scan results: Synops is : The remote service encrypts traffic using a protocol with known weaknesses . Description : The remote service accepts connections encrypted using SSL ...
I need to ensure PCI compliance by limiting mod_ssl to SSLv3 and TLSv1, and ensuring long keys. I've tried the following configuration, but certain combinations of SSLv2 seems to still be valid: ...